Wordpress Plugin CVE-2025-64289

While the CVSS score of 5.9 (medium) reflects potential confidentiality, integrity, and availability impacts with network access and low complexity, multiple risk signals indicate this is a low-priority vulnerability in practice. The EPSS score of 0.02% (6th percentile) shows extremely low exploitation probability despite public vulnerability disclosure. The attack requires PR:H (high-privilege attacker, i.e., site administrator) and UI:R (user interaction-victims must view the malicious content), significantly raising the barrier to exploitation. This is a classic admin-to-admin or admin-to-user attack requiring existing site access; external attackers cannot trigger it without prior compromise. The lack of active exploitation (no KEV status, no known POC) and low EPSS combined with authentication/interaction requirements classify this as a lower-priority vulnerability appropriate for standard patching cycles rather than emergency response, despite the stored XSS severity classification.

A malicious WordPress administrator with high-level plugin management permissions injects a stored XSS payload into a Premmerce search filter setting or product attribute field, storing it in the plugin's data backend. When site editors, other admins, or customers subsequently view product search results or pages where that filter is rendered, the JavaScript payload executes in their browser session, allowing the attacker to steal session cookies, redirect users to phishing sites, or capture form input (e.g., login credentials). The attack succeeds only when victims actually view the compromised content, making it a low-velocity but persistent threat in multi-admin environments.