Security readout for executives and security teams
Plain-English summary
Older DELUCKS SEO WordPress plugin versions let unauthenticated attackers store malicious browser script through plugin settings. That script could run when someone views affected pages, creating risk to site visitors and administrators. The business concern is website integrity and potential session or content abuse, not server takeover from the CVE alone.
Executive priority
Prioritize remediation for any public WordPress site using DELUCKS SEO before 2.1.8. This is high urgency because unauthenticated attackers may persist script in site content, and cited reporting indicates exploitation activity despite no KEV listing.
Technical view
CVE-2019-25146 is stored XSS in DELUCKS SEO up to and including 2.1.7. The saveSettings() function lacked capability checks, and inputs were not sufficiently sanitized or output escaped. The CVSS 3.1 score is 7.2, with network access, low complexity, no privileges, and changed scope.
Likely exposure
Exposure is limited to WordPress sites running DELUCKS SEO versions before 2.1.8. The source metadata is partly inconsistent because one affected entry lists version 0 with defaultStatus unaffected, while the description and references identify versions through 2.1.7.
Exploitation context
The bundle marks CISA KEV as false. However, a cited Nintechnet reference explicitly describes active exploitation, and Plugin Vulnerabilities reported possible targeting in 2019. Treat internet-facing WordPress sites with this plugin as urgent to verify.
Researcher notes
Focus validation on plugin version, saveSettings exposure, stored payload indicators, and whether patched code added authorization, sanitization, and escaping. Avoid relying only on the affected CPE-style metadata because the bundle contains conflicting affected-status data.
Mitigation direction
- Upgrade DELUCKS SEO to version 2.1.8 or later if available.
- Remove DELUCKS SEO if it is unused or unsupported.
- Review vendor guidance before changing production WordPress sites.
- Inspect and clean suspicious stored plugin settings or injected page content.
- Keep WordPress, themes, and other plugins current.
Validation and detection
- Inventory WordPress sites for the DELUCKS SEO plugin.
- Confirm no deployed instance is version 2.1.7 or older.
- Review rendered pages for unexpected scripts or SEO content changes.
- Check web and security logs for suspicious plugin settings activity.
- Document remediation status for each affected site.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2019-25146 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N3.92.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.2HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/aaa2f738-4764-467c-9544-889ca8ba73d1?source=cveCVE reference
- https://blog.nintechnet.com/vulnerability-in-the-wordpress-delucks-seo-plugin-actively-exploited/CVE reference
- https://plugins.trac.wordpress.org/changeset/2161211CVE reference
- https://www.pluginvulnerabilities.com/2019/09/21/hackers-may-already-be-targeting-this-persistent-xss-vulnerability-in-delucks-seo/CVE reference
- https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-delucks-seo-cross-site-scripting-2-1-7/CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.