Security readout for executives and security teams
Plain-English summary
A reflected cross-site scripting flaw exists in the WordPress "Hello Followers" plugin (versions through 2.5). An attacker who tricks a logged-in user into clicking a crafted link could run script in the victim's browser, potentially leading to account takeover or content tampering on the affected site.
Executive priority
Medium-high priority for any business running WordPress with this plugin. The flaw is browser-side and requires a user to click a malicious link, but successful exploitation can hijack admin sessions and damage the brand. Patch or remove the plugin promptly; non-users can deprioritize.
Technical view
CWE-79 reflected XSS in appscreo Hello Followers plugin (hellofollowers) up to and including version 2.5. CVSS 3.1 score 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Scope-changed impact reflects script execution in the user's browser context against the WordPress site, requiring user interaction to follow a crafted URL.
Likely exposure
Limited to WordPress sites running the Hello Followers plugin at version 2.5 or earlier. Risk rises for sites with administrator or editor accounts that browse externally received links. Sites without this plugin installed are not exposed.
Exploitation context
No CISA KEV listing and no public reports of active exploitation cited in the source bundle. Exploitation requires social engineering a logged-in user to click an attacker-crafted URL. Patchstack has catalogued the issue as a vendor disclosure entry.
Researcher notes
Reflected XSS with CVSS 7.1 and S:C indicates script can affect resources beyond the vulnerable component, consistent with browser-based session impact on the WordPress origin. CVE record shows defaultStatus "unaffected" with versions ["0"], so confirm fixed-version metadata against Patchstack before declaring closure. No public PoC referenced in the bundle.
Mitigation direction
- Inventory WordPress sites for the Hello Followers plugin and record installed versions.
- Check vendor and Patchstack guidance for a fixed release and apply the update once available.
- If no patch is available, deactivate and remove the Hello Followers plugin from affected sites.
- Restrict administrative access using SSO, MFA, and least-privilege roles to limit XSS impact.
- Deploy a web application firewall ruleset that blocks reflected XSS payloads on WordPress endpoints.
Validation and detection
- Run wp plugin list or scan the wp-content/plugins directory to confirm hellofollowers presence and version.
- Compare installed version against the vendor's fixed release once published on Patchstack.
- Review WordPress and WAF logs for suspicious query strings targeting plugin endpoints.
- After remediation, retest with a controlled internal review to confirm the parameter no longer reflects unsanitized input.
- Confirm administrator sessions have not been used from unfamiliar IPs or user agents recently.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-52770 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L2.83.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.