CVE-2025-7431
BaseFortify
Publication date: 2025-07-18
Last updated on: 2025-07-22
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordfence | knowledge_base | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-7431 is a Stored Cross-Site Scripting (XSS) vulnerability in the Knowledge Base plugin for WordPress, affecting all versions up to and including 2.3.1. It occurs due to insufficient input sanitization and output escaping of the plugin slug setting. Authenticated attackers with administrator-level access can inject arbitrary web scripts into pages. These scripts execute whenever a user accesses the injected page. This vulnerability specifically affects multi-site WordPress installations and installations where the unfiltered_html setting is disabled.
How can this vulnerability impact me? :
This vulnerability can allow an attacker with administrator privileges to inject malicious scripts into the website pages. When other users visit these pages, the injected scripts execute in their browsers, potentially leading to theft of sensitive information, session hijacking, or performing actions on behalf of the user without their consent. Since it is a stored XSS, the malicious code persists on the site and affects all users who access the compromised pages. This can damage the website's integrity, user trust, and security.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update the Knowledge Base plugin for WordPress to a version later than 2.3.1 where the issue is fixed. Additionally, ensure that only trusted administrators have access to the plugin settings, especially in multi-site installations or where unfiltered_html is disabled. Consider reviewing and restricting administrator-level access and monitor for any suspicious script injections in pages related to the plugin slug setting. [1]