Platform
wordpress
Component
vayvo-progression
Fixed in
6.8.1
CVE-2026-25373 describes a Reflected Cross-Site Scripting (XSS) vulnerability discovered in ProgressionStudios Vayvo. This flaw allows attackers to inject malicious scripts into web pages, potentially leading to session hijacking, data theft, or defacement. The vulnerability impacts Vayvo versions from 0.0.0 up to, but not including, version 6.8. A patch is available in version 6.8.
The impact of this Reflected XSS vulnerability is significant. An attacker could craft a malicious URL containing JavaScript code and trick a user into clicking it. Upon visiting the crafted URL, the injected script would execute within the user's browser context, with the same privileges as the user. This could allow an attacker to steal session cookies, redirect the user to a phishing site, or even modify the content of the web page. The blast radius extends to any user who interacts with a vulnerable Vayvo-powered website, making it a widespread concern.
CVE-2026-25373 was publicly disclosed on 2026-03-25. No public proof-of-concept (PoC) code has been identified at the time of writing, but the nature of Reflected XSS vulnerabilities means that exploitation is relatively straightforward once a vulnerable endpoint is identified. The EPSS score is likely to be medium, given the ease of exploitation and potential impact. It is not currently listed on the CISA KEV catalog.
Exploit Status
EPSS
0.04% (11% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-25373 is to upgrade Vayvo to version 6.8 or later, which includes the necessary fix. If immediate upgrading is not possible, consider implementing input validation and output encoding on all user-supplied data to prevent script injection. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Regularly review and update your WordPress installation and all plugins to minimize the attack surface.
Update to version 6.8, or a newer patched version
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-25373 is a Reflected XSS vulnerability in ProgressionStudios Vayvo, allowing attackers to inject malicious scripts via web page generation. It's rated HIGH severity (7.1 CVSS).
You are affected if you are using Vayvo versions 0.0.0 through 6.8. Upgrade to version 6.8 to mitigate the risk.
Upgrade Vayvo to version 6.8 or later. Implement input validation and output encoding as a temporary workaround.
While no public exploits are currently known, the ease of exploitation for Reflected XSS suggests potential for active exploitation.
Refer to the ProgressionStudios website or their official security advisory channels for the latest information and updates regarding CVE-2026-25373.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.