Jannah Extensions CVE-2025-64208

Exploitation requires an authenticated WordPress user with at least low-level privileges (CVSS PR:L) on a site running the Jannah - Extensions plugin version 1.1.4 or earlier, and additionally requires a victim to interact by viewing the page carrying the DOM-based payload (CVSS UI:R). The description does not name the exact vulnerable parameter, endpoint, or configuration toggle, so the specific feature carrying the injection cannot be stated from available data. The key limiting factors are the combination of required authentication and required victim interaction, plus the partial (Low) impact ceiling, which together make opportunistic mass exploitation unlikely.

This is a moderate-severity, low-priority issue. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, base 6.5) describes a network-reachable DOM-based XSS that nevertheless requires BOTH authenticated access (PR:L - a low-privileged WordPress account such as contributor/author) AND victim user interaction (UI:R), with only partial (Low) impact to confidentiality, integrity, and availability. These dual preconditions substantially blunt real-world risk despite the network attack vector. The EPSS score of 0.17% (5th percentile) is very low and consistent with the absence of exploitation signals: the CVE is NOT in CISA KEV and there is no public exploit code identified at time of analysis. No SSVC decision data was provided in the input. All signals align in the same direction - low exploitation probability, no active exploitation, no POC, and meaningful access/interaction prerequisites - so this is a genuine high-CVSS-relative-to-real-risk case that should be patched in routine maintenance rather than treated as an emergency. The only mild amplifier is the Scope:Changed metric, reflecting that injected script executes in a victim's browser context beyond the vulnerable component.

An attacker holding a low-privileged authenticated WordPress account on a site running the Jannah - Extensions plugin (<= 1.1.4) crafts input that is unsafely written into the DOM, planting a malicious script. A higher-privileged user (e.g. an administrator) who then views the attacker-influenced page triggers the script in their browser, enabling session or action abuse within that user's context. No public exploit code or active exploitation has been identified at time of analysis.