Plataforma
wordpress
Componente
vayvo-progression
Corrigido em
6.8.1
CVE-2026-25373 describes a Reflected Cross-Site Scripting (XSS) vulnerability discovered in ProgressionStudios Vayvo. This flaw allows attackers to inject malicious scripts into web pages, potentially leading to session hijacking, data theft, or defacement. The vulnerability impacts Vayvo versions from 0.0.0 up to, but not including, version 6.8. A patch is available in version 6.8.
The impact of this Reflected XSS vulnerability is significant. An attacker could craft a malicious URL containing JavaScript code and trick a user into clicking it. Upon visiting the crafted URL, the injected script would execute within the user's browser context, with the same privileges as the user. This could allow an attacker to steal session cookies, redirect the user to a phishing site, or even modify the content of the web page. The blast radius extends to any user who interacts with a vulnerable Vayvo-powered website, making it a widespread concern.
CVE-2026-25373 was publicly disclosed on 2026-03-25. No public proof-of-concept (PoC) code has been identified at the time of writing, but the nature of Reflected XSS vulnerabilities means that exploitation is relatively straightforward once a vulnerable endpoint is identified. The EPSS score is likely to be medium, given the ease of exploitation and potential impact. It is not currently listed on the CISA KEV catalog.
Websites utilizing ProgressionStudios Vayvo, particularly those with user input fields or dynamic content generation, are at risk. Shared hosting environments where multiple websites share the same server resources are also particularly vulnerable, as a compromise of one site could potentially lead to the compromise of others.
• wordpress / composer / npm:
grep -r "vayvo-progression" /var/www/html
grep -r "<script>" /var/www/html• generic web:
curl -I https://example.com/?param=<script>alert(1)</script>disclosure
Status do Exploit
EPSS
0.04% (percentil 11%)
CISA SSVC
Vetor CVSS
The primary mitigation for CVE-2026-25373 is to upgrade Vayvo to version 6.8 or later, which includes the necessary fix. If immediate upgrading is not possible, consider implementing input validation and output encoding on all user-supplied data to prevent script injection. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Regularly review and update your WordPress installation and all plugins to minimize the attack surface.
Update to version 6.8, or a newer patched version
Análise de vulnerabilidades e alertas críticos diretamente no seu e-mail.
CVE-2026-25373 is a Reflected XSS vulnerability in ProgressionStudios Vayvo, allowing attackers to inject malicious scripts via web page generation. It's rated HIGH severity (7.1 CVSS).
You are affected if you are using Vayvo versions 0.0.0 through 6.8. Upgrade to version 6.8 to mitigate the risk.
Upgrade Vayvo to version 6.8 or later. Implement input validation and output encoding as a temporary workaround.
While no public exploits are currently known, the ease of exploitation for Reflected XSS suggests potential for active exploitation.
Refer to the ProgressionStudios website or their official security advisory channels for the latest information and updates regarding CVE-2026-25373.
Envie seu arquivo de dependências e descubra na hora se esta e outras CVEs te atingem.
Envie seu arquivo de dependências e descubra na hora se esta e outras CVEs te atingem.