Atomic Edge analysis of CVE-2025-67972 (metadata-based):
The Prague WordPress plugin version 2.2.8 and earlier contains an unauthenticated stored cross-site scripting (XSS) vulnerability. This flaw exists due to insufficient input sanitization and output escaping in one or more plugin components. Attackers can inject arbitrary JavaScript payloads that persist in the WordPress database and execute in victim browsers when viewing compromised pages. The CVSS 7.2 score reflects the network attack vector, low attack complexity, no privilege requirements, no user interaction, and scope change with confidentiality and integrity impacts.
Atomic Edge research identifies the root cause as CWE-79, improper neutralization of input during web page generation. The vulnerability description confirms insufficient input sanitization and output escaping. Without access to source code, we infer the plugin likely processes user-supplied data through AJAX handlers, REST API endpoints, or form submissions without adequate validation. The data is then stored and later rendered without proper escaping functions like esc_html() or esc_attr(). These conclusions are inferred from the CWE classification and WordPress plugin patterns rather than confirmed via code review.
Exploitation requires unauthenticated attackers to send malicious payloads to vulnerable endpoints. Based on WordPress plugin conventions, the attack likely targets an AJAX action parameter via /wp-admin/admin-ajax.php or a REST API endpoint. A typical payload would be alert(document.domain) or similar JavaScript in a parameter the plugin processes. The payload persists in the database, executing whenever users access the injected content. Attackers could steal session cookies, redirect users, or perform actions as authenticated users.
The remediation likely involves implementing proper input validation and output escaping. The patched version 2.2.9 probably adds sanitization functions like sanitize_text_field() for input and escaping functions like esc_html() for output. WordPress security best practices require nonce verification and capability checks for authenticated endpoints, but this vulnerability affects unauthenticated users, suggesting missing authentication checks entirely. Developers should validate all user input against allowlists and escape all dynamic content before rendering.
Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in victim browsers. This can lead to session hijacking, administrative account takeover, site defacement, or malware distribution. The stored nature means a single injection affects all users viewing the compromised content. Attackers could manipulate site functionality, redirect users to malicious sites, or steal sensitive information displayed on affected pages. The scope change (S:C) in the CVSS vector indicates the vulnerability can impact components beyond the plugin’s security scope.
