CVE-2025-62967
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The DirectoryPress plugin (directorypress) is vulnerable to DOM-Based XSS due to improper neutralization of input during web page generation. This issue affects versions from n/a through <= 3.6.25.
Risk Assessment
An attacker can execute a malicious script in the victim's browser context, potentially leading to session data theft or unauthorized actions.
Recommendation
Update the DirectoryPress plugin to a version later than 3.6.25 or disable it if no update is available.
Other vulnerabilities in DirectoryPress
See all- CVE-2026-62032Critical
Local File Inclusion vulnerability in DirectoryPress versions up to and including 3.6.27. An unauthenticated attacker can include local files, potentially leading to information disclosure or code execution. The issue affects unauthenticated access.
- CVE-2026-39566Medium
The DirectoryPress plugin for WordPress exposes sensitive system information to unauthorized entities. The vulnerability allows retrieval of embedded sensitive data.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Designinvento DirectoryPress directorypress allows DOM-Based XSS.This issue affects DirectoryPress: from n/a through <= 3.6.25.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS