CVE-2025-67622: XSS in Evergreen Post Tweeter

Successful exploitation of CVE-2025-67622 allows an attacker to inject arbitrary JavaScript code into the Evergreen Post Tweeter plugin. This code can then be executed in the context of any user visiting a vulnerable page, leading to a range of malicious activities. An attacker could steal user session cookies, redirect users to phishing sites, or deface the website. The impact is particularly severe for websites with sensitive user data or high traffic, as a single successful attack could compromise a large number of users. This vulnerability shares similarities with other XSS vulnerabilities where user input is not properly sanitized before being displayed.

1. Reserved2025-12-09
2. Published2025-12-24
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-67622 is to upgrade to a patched version of the Evergreen Post Tweeter plugin as soon as it becomes available. Until a patch is released, consider implementing temporary workarounds such as restricting access to the affected functionality or implementing strict input validation on user-supplied data. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can also provide a layer of protection. Monitor website logs for suspicious activity, particularly unusual JavaScript execution patterns.

Active installs

30Niche

Plugin rating