What is the CVSS score of CVE-2026-2425?

CVE-2026-2425 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

hiWeb Migration Simple CVE-2026-2425

EUVD-2026-33891 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-02 Wordfence

GHSA-f55w-q2x3-pjpf

WordPress XSS Wordpress Plugin Hiweb Migration Simple

6.1

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 08:47 vuln.today

CVE Published

Jun 02, 2026 - 07:48 nvd

MEDIUM 6.1

DescriptionCVE.org

The hiWeb Migration Simple plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'new_domain' parameter in all versions up to, and including, 2.0.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.

AnalysisAI

Reflected Cross-Site Scripting in the hiWeb Migration Simple WordPress plugin (all versions up to and including 2.0.0.1) allows unauthenticated remote attackers to inject arbitrary JavaScript via the unsanitized 'new_domain' parameter rendered in template/force-re-migrate-confirm.php. Exploitation requires tricking a logged-in WordPress administrator into clicking a crafted URL, at which point the injected script executes in the administrator's browser session under the site's origin - a Changed scope per CVSS - enabling potential account takeover or unauthorized admin-level actions. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in source intelligence.

Technical ContextAI

The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic reflected XSS pattern. The affected component is template/force-re-migrate-confirm.php at line 6, as confirmed by the WordPress plugin Trac references, where the 'new_domain' GET parameter is echoed directly into page output without sanitization or contextual escaping. The affected vendor product is identified via CPE as cpe:2.3:a:den-media:hiweb_migration_simple:*:*:*:*:*:*:*:* (vendor: den-media), covering all releases up to and including the 2.0.0.1 tag. The CVSS vector S:C (Scope Changed) indicates that the injected script executes in the victim browser's security context rather than the attacker's, which is consistent with reflected XSS delivered via a crafted link to an authenticated user. The plugin's migration functionality - presumably used to update site domain references - exposes this parameter in an administrative confirmation template, making administrators the natural high-value target.

RemediationAI

No vendor-released patched version has been identified in the available intelligence at time of analysis - the highest known version is 2.0.0.1, which remains vulnerable. Site administrators running any version of hiWeb Migration Simple should disable or remove the plugin immediately until a patched release is confirmed available via the WordPress plugin repository or the den-media vendor. As a compensating control, Web Application Firewall (WAF) rules blocking reflected XSS payloads in the 'new_domain' query parameter can reduce exploitation risk without requiring plugin removal, though WAF bypass is always possible and should not be treated as a permanent fix. Additionally, administrators should exercise heightened caution around unsolicited links referencing WordPress admin URLs while this plugin remains active. The Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/5817384f-1626-4393-a879-931fe7e551f1) and the plugin Trac (https://plugins.trac.wordpress.org/browser/hiweb-migration-simple/) should be monitored for patch availability.