CVE-2025-58823
BaseFortify
Publication date: 2025-09-05
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| the_african_boss | get_cash | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the WordPress Get Cash Plugin versions up to 3.2.2. It allows an attacker with contributor-level privileges to inject malicious scripts, such as redirects, advertisements, or other HTML payloads, into the website. These scripts execute when visitors access the site, potentially compromising the site's integrity and user experience. [1]
How can this vulnerability impact me? :
The vulnerability can impact you by allowing attackers to execute malicious scripts on your website, which can lead to unauthorized redirects, display of unwanted advertisements, or other harmful HTML content. This can degrade user trust, harm your website's reputation, and potentially lead to further exploitation. However, the risk is considered minimal due to the low severity and unlikely exploitation, and no official patch is currently available. Virtual patching is recommended as a mitigation. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves monitoring for suspicious script injections or unexpected HTML payloads in the content created by contributor-level users on the Get Cash plugin (up to version 3.2.2). Since no specific detection commands are provided, general web application security scanning tools or manual inspection of user-generated content for injected scripts can be used. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying virtual patching (vPatching) as recommended by Patchstack to auto-mitigate the vulnerability since no official patch is available. Additionally, monitor for updates from the plugin developer and restrict contributor-level privileges where possible to reduce risk. [1]