CVE-2025-67986: 
WordPress vulnerability analysis and mitigation

CVE-2025-67986 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the Barn2 Plugins Document Library Lite WordPress plugin. It affects all versions of the plugin through 1.1.7 and was disclosed on December 16, 2025, with the CVE assigned by Patchstack. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and carries a CVSS v3.1 base score of 5.9 (Medium), as scored by Patchstack (Patchstack).

The vulnerability stems from insufficient sanitization of user-controlled input that is written directly into the DOM, enabling DOM-Based XSS (CWE-79, CAPEC-588). Exploitation requires the attacker to have high privileges (e.g., administrator-level access) on the WordPress site and requires user interaction — specifically, a victim must visit or interact with a crafted page. The attack vector is network-based with low attack complexity, and the scope is changed, meaning the injected script can affect resources beyond the vulnerable component itself (Patchstack).

Successful exploitation of this vulnerability allows an attacker with high privileges to inject malicious scripts into web pages viewed by other users, resulting in low-level impacts to confidentiality, integrity, and availability. The changed scope indicates that the injected script can execute in the context of a different security domain, potentially enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim user. Given the high privilege requirement, the practical impact is somewhat limited but could still be leveraged in scenarios such as admin account compromise or targeted attacks against site users.

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been identified for CVE-2025-67986. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The high privilege requirement further reduces the likelihood of opportunistic exploitation.

Users of the Document Library Lite plugin by Barn2 Plugins should update to a version beyond 1.1.7 as soon as a patched release is available. In the interim, site administrators should restrict plugin configuration access to trusted administrators only and monitor for unexpected changes to plugin settings or page content. Implementing a Web Application Firewall (WAF) with XSS filtering rules can provide an additional layer of defense (Patchstack).