CVE-2025-62967

MediumCVSS 6.5

Published: 27/10/2025(UTC)Updated: 05/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

5th percentile - higher than 5% of all known CVEs

Summary

The DirectoryPress plugin (directorypress) is vulnerable to DOM-Based XSS due to improper neutralization of input during web page generation. This issue affects versions from n/a through <= 3.6.25.

Risk Assessment

An attacker can execute a malicious script in the victim's browser context, potentially leading to session data theft or unauthorized actions.

Recommendation

Update the DirectoryPress plugin to a version later than 3.6.25 or disable it if no update is available.

Other vulnerabilities in DirectoryPress

CVE-2026-39566Medium
The DirectoryPress plugin for WordPress exposes sensitive system information to unauthorized entities. The vulnerability allows retrieval of embedded sensitive data.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Designinvento DirectoryPress directorypress allows DOM-Based XSS.This issue affects DirectoryPress: from n/a through <= 3.6.25.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS