CVE-2025-58632
BaseFortify
Publication date: 2025-09-03
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dadevarzan | wordpress_common | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-58632 is a Cross Site Scripting (XSS) vulnerability in the Dadevarzan WordPress Common Plugin versions up to 2.2.2. It allows a malicious actor with contributor-level privileges to inject harmful scripts, such as redirects or advertisements, into a website. These scripts execute when visitors access the site, potentially compromising the site's integrity and user experience. The vulnerability is classified under OWASP Top 10 category A3: Injection and has a CVSS score of 6.5, indicating a low severity impact. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to inject malicious scripts into your website, which execute when visitors access it. This can lead to unwanted redirects, display of malicious advertisements, or other harmful HTML payloads that compromise user trust and site functionality. Although the severity is considered low and exploitation is unlikely, unpatched sites are vulnerable to automated opportunistic attacks. It is recommended to update the plugin to version 2.2.3 or later to eliminate the risk. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves checking if the Dadevarzan WordPress Common plugin version is 2.2.2 or earlier, as these versions are affected. Since the vulnerability allows stored XSS via contributor-level privileges, monitoring for unusual script injections or unexpected HTML payloads in the website content can help. However, plugin-based malware scanners are often compromised and not reliable for this vulnerability. Professional incident response or malware scanning by hosting providers is recommended for suspected compromises. Specific commands are not provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the Dadevarzan WordPress Common plugin to version 2.2.3 or later, where the vulnerability is fixed. Additionally, Patchstack offers virtual patching (vPatching) that can auto-mitigate the vulnerability before official patches are applied, providing rapid protection without performance loss. Users are advised to apply these updates promptly to prevent exploitation, even though the vulnerability is considered low priority. [1]