CVE-2025-67556

MediumCVSS 5.9

Published: 09/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

10th percentile - higher than 10% of all known CVEs

Summary

The Advanced FAQ Manager plugin for WordPress (versions up to 1.5.2) is vulnerable to stored XSS due to improper neutralization of input during web page generation. An attacker can inject malicious scripts that are stored and executed in other users' browsers.

Risk Assessment

An attacker can execute arbitrary JavaScript in the victim's browser, potentially leading to session theft, account takeover, or website content modification.

Recommendation

Update the Advanced FAQ Manager plugin to a version later than 1.5.2 or remove it if not in use.

Other vulnerabilities in Advanced FAQ Manager

CVE-2025-67553Medium
The Advanced FAQ Manager plugin for WordPress (up to version 1.5.2) has a DOM-Based XSS vulnerability due to improper input neutralization during page generation. An attacker can inject malicious script that executes in the victim's browser.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHigh Advanced FAQ Manager advanced-faq-manager allows Stored XSS.This issue affects Advanced FAQ Manager: from n/a through <= 1.5.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS