CVE-2025-67553

MediumCVSS 6.5

Published: 09/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

The Advanced FAQ Manager plugin for WordPress (up to version 1.5.2) has a DOM-Based XSS vulnerability due to improper input neutralization during page generation. An attacker can inject malicious script that executes in the victim's browser.

Risk Assessment

Risk of user session hijacking, data theft, or unauthorized actions in the victim's browser context.

Recommendation

Update the plugin to the latest version if available, and implement input and output sanitization mechanisms.

Other vulnerabilities in Advanced FAQ Manager

CVE-2025-67556Medium
The Advanced FAQ Manager plugin for WordPress (versions up to 1.5.2) is vulnerable to stored XSS due to improper neutralization of input during web page generation. An attacker can inject malicious scripts that are stored and executed in other users' browsers.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHigh Advanced FAQ Manager advanced-faq-manager allows DOM-Based XSS.This issue affects Advanced FAQ Manager: from n/a through <= 1.5.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS