CVE-2025-58238
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The PilotPress plugin for WordPress (versions up to and including 2.0.36) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. A malicious script can be persistently stored and executed in the user's browser.
Risk Assessment
An attacker can execute arbitrary JavaScript in the victim's session, steal cookies, redirect the user, or perform actions on their behalf. This may lead to credential theft and privilege escalation.
Recommendation
Update the PilotPress plugin to a version newer than 2.0.36. Additionally, deploy CSP headers and regularly scan the site for malicious scripts.
Other vulnerabilities in PilotPress
See all- CVE-2026-85659High
The PilotPress plugin for WordPress (versions up to and including 2.0.43) is vulnerable to privilege escalation via account takeover. The update_cc_details() AJAX handler forwards an attacker-supplied username to ONTRAPORT before the local username_exists() collision check, and aborts without rolling back the remote rename when a collision is detected, allowing an authenticated Subscriber-level attacker to take over an Administrator account.
- CVE-2025-58221Medium
Missing Authorization vulnerability in PilotPress (versions up to 2.0.36) allows exploiting incorrectly configured access control security levels.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ONTRAPORT PilotPress pilotpress allows Stored XSS.This issue affects PilotPress: from n/a through <= 2.0.36.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS