CVE-2025-67964
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-01-29
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| favethemes | homey_core | to 2.4.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-67964 is a medium severity Cross Site Scripting (XSS) vulnerability in the WordPress Homey Core Plugin versions up to 2.4.3. It allows an attacker to inject malicious scripts, such as redirects or advertisements, into a website. These scripts execute when visitors access the site. Exploitation requires a privileged user to interact with malicious content, like clicking a link or submitting a form. The vulnerability falls under the OWASP Top 10 category A3: Injection and was fixed in version 2.4.4 of the plugin. [1]
How can this vulnerability impact me? :
This vulnerability can allow attackers to execute malicious scripts on your website, potentially leading to unauthorized actions such as redirecting users to malicious sites, displaying unwanted advertisements, or stealing sensitive information. It requires a privileged user to interact with malicious content, which could compromise the security and integrity of your website and its users. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this Cross Site Scripting (XSS) vulnerability in the Homey Core Plugin can be done by monitoring for suspicious script injections or unusual HTML payloads in web traffic or logs. While no specific commands are provided, users can scan their WordPress installation to check the plugin version (to see if it is ≤ 2.4.3) using commands like `wp plugin list` via WP-CLI. Additionally, web application scanners or security tools that detect XSS vulnerabilities can be used to test the affected pages. Patchstack also provides mitigation rules that can help detect and block attacks automatically until the plugin is updated. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the Homey Core Plugin to version 2.4.4 or later, which contains the fix for this vulnerability. Until the update can be applied, users should enable Patchstack mitigation rules that can block attacks automatically. Enabling auto-updates for vulnerable plugins through Patchstack’s platform is also recommended to ensure timely protection. [1]