CVE-2025-67545

MediumCVSS 6.5

Published: 09/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FirePlugins FireBox firebox allows Stored XSS. This issue affects FireBox: from n/a through <= 3.1.0-free.

Risk Assessment

An attacker can persistently inject malicious script that executes when a user visits the infected page, potentially leading to data theft or session hijacking. This impacts the confidentiality and integrity of user data.

Recommendation

Update the FireBox plugin to a version newer than 3.1.0-free as soon as it becomes available. Until then, consider limiting its use or implementing additional XSS protections.

Other vulnerabilities in FireBox

CVE-2026-76801High
The FireBox plugin for WordPress (up to version 3.1.10) is vulnerable to Remote Code Execution due to a bypassable regex blacklist in Executer::allowedToRun() and lack of sanitization of PHP condition rule values stored via the firebox_meta REST endpoint. Authenticated attackers with author-level access or above can execute code on the server. On sites upgraded from a version prior to 3.1.10, the Migrator::preserveCampaignRoleAccess() function automatically grants the Author role the edit_fireboxes and publish_fireboxes capabilities, lowering the effective entry point to Author-level access.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FirePlugins FireBox firebox allows Stored XSS.This issue affects FireBox: from n/a through <= 3.1.0-free.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS