CVE-2025-50014
BaseFortify
Publication date: 2025-06-20
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross Site Scripting (XSS) issue in the WordPress PDPA Consent for Thailand plugin versions up to 1.1.1. It allows an attacker with administrator privileges to inject malicious scripts, such as redirects, advertisements, or other HTML payloads, into the website. These scripts execute when visitors access the site, potentially compromising user experience and security. [1]
How can this vulnerability impact me? :
The vulnerability can impact you by allowing an attacker with admin access to inject malicious scripts into your website. These scripts can execute when visitors access the site, potentially leading to compromised user experience, unauthorized redirects, unwanted advertisements, or other harmful effects on website security and integrity. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the WordPress site is running the PDPA Consent for Thailand plugin version 1.1.1 or earlier, as these versions contain the XSS vulnerability. Since the vulnerability requires administrator privileges to exploit, verifying plugin version and monitoring for suspicious administrator activity or injected scripts in web pages can help detect exploitation. Specific commands are not provided, but typical steps include using WP-CLI to list plugin versions (e.g., 'wp plugin list') and inspecting web page source for unexpected scripts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include replacing the vulnerable PDPA Consent for Thailand plugin with an alternative solution, as no official patch or fix is available. Simply deactivating the plugin is insufficient unless a virtual patch (vPatch) is applied. Applying virtual patching is recommended to auto-mitigate the vulnerability without requiring an official fix. [1]