Security readout for executives and security teams
Plain-English summary
A flaw in the WP-Click-Tracker WordPress plugin (versions through 0.7.3) lets an attacker craft a malicious link that, when clicked by a logged-in user, runs unwanted code in their browser. This could expose admin sessions or be used to deface site content. Risk is limited to sites running this specific plugin.
Executive priority
Medium-high priority for any business running WordPress with this plugin; low for everyone else. Action is cheap (remove or update the plugin) and prevents attacker hijack of admin sessions, which on a marketing site can lead to defacement, SEO poisoning, or malware injection that damages brand trust.
Technical view
Reflected Cross-Site Scripting (CWE-79) in mithra62 WP-Click-Tracker plugin <= 0.7.3. CVSS 3.1 base 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Unauthenticated attacker delivers a crafted URL; victim interaction executes script in the victim's browser context with scope change, enabling session theft, admin action abuse, or content manipulation on the WordPress site.
Likely exposure
Limited to WordPress sites that have the WP-Click-Tracker (wp-click-track) plugin installed and active at version 0.7.3 or earlier. The plugin appears to have a small install base, so broad enterprise exposure is unlikely, but any site running it is potentially at risk.
Exploitation context
No KEV listing and no public reports of in-the-wild exploitation cited in the source bundle. Exploitation requires a victim (often an authenticated administrator) to click an attacker-supplied link. Reflected XSS in WordPress plugins is regularly weaponized in phishing campaigns once details circulate.
Researcher notes
CVSS 7.1 with Scope:Changed reflects browser-context impact reaching beyond the vulnerable component. UI:R means a victim must interact with a crafted URL. Affected metadata in the CVE record is sparse (versions:["0"], defaultStatus:"unaffected"), so rely on the Patchstack advisory for the authoritative <= 0.7.3 range. No fixed version is named in the bundle; verify vendor guidance directly.
Mitigation direction
- Inventory WordPress sites for the WP-Click-Tracker (wp-click-track) plugin.
- If installed, deactivate and remove the plugin until a vendor-patched version is confirmed.
- Check Patchstack and the plugin page for an updated release and apply it.
- Apply WAF rules that block reflected XSS payloads to wp-admin and plugin endpoints.
- Require admins to avoid clicking unsolicited links to wp-admin URLs.
Validation and detection
- Search WordPress installs for the wp-click-track plugin slug and record version.
- Confirm installed version against the <= 0.7.3 affected range from Patchstack.
- Review web server and WAF logs for suspicious query strings hitting plugin endpoints.
- After remediation, re-scan with a vulnerability scanner to confirm the plugin is removed or patched.
- Rotate admin session cookies and credentials if exploitation is suspected.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-49954 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L2.83.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.