PT-2025-4574 · WordPress · Wpex Replace Db Urls

0Xd4Rk5Id3 · Published 2025-01-13 · Updated 2025-01-13 · CVE-2025-22586

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

The vulnerable software is WPEX Replace DB Urls, developed by Detlef Stöver. The vulnerability is an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS), which allows Reflected XSS. This issue affects WPEX Replace DB Urls versions from n/a through 0.4.0. The vulnerability has been assigned the CVE identifier CVE-2025-22586. There is no information provided about a public exploit or whether the vulnerability has been exploited by attackers. Additionally, there is no information about the number of Internet users that can be affected by the exploitation of this vulnerability. It is recommended to update WPEX Replace DB Urls to a version later than 0.4.0 to prevent potential attacks.

#WPEXReplaceDBUrls #CrossSiteScripting #XSS #ReflectedXSS #CVE202522586 #DetlefStöver #ImproperNeutralizationOfInput #WebPageGeneration #Vulnerability

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-22586

Affected Products

Wpex Replace Db Urls

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-22586 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/wpex-replace/vulnerability/wordpress-wpex-replace-db-urls-plugin-0-4-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/wordpress/plugin/wpex-replace/vulnerability/wordpress-wpex-replace-db-urls-plugin-0-4-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/VulmonFeeds/status/1878857691537277020 · Twitter Post
• https://twitter.com/CVEnew/status/1878799449016660215 · Twitter Post
• https://t.me/cvedetector/15139 · Telegram Post