CVE-2025-3832

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-3832", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-04-20T15:13:42.937Z", "datePublished": "2025-04-24T08:23:50.608Z", "dateUpdated": "2026-04-08T17:18:22.388Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:18:22.388Z"}, "affected": [{"vendor": "jeremyshapiro", "product": "FuseDesk", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The FuseDesk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018successredirect\u2019 parameter in all versions up to, and including, 6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "FuseDesk <= 6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via successredirect Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/baf12413-eb45-44c3-a6c9-f5a048d6500d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/fusedesk/trunk/fusedesk.php#L516"}, {"url": "https://wordpress.org/plugins/fusedesk/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3282801/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Thaleikis"}], "timeline": [{"time": "2025-04-23T19:47:53.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-24T13:52:45.469395Z", "id": "CVE-2025-3832", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-24T13:53:02.572Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3832", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-24T13:52:45.469395Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-24T13:52:56.707Z"}}], "cna": {"title": "FuseDesk <= 6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via successredirect Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Peter Thaleikis"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "jeremyshapiro", "product": "FuseDesk", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "6.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-04-23T19:47:53.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/baf12413-eb45-44c3-a6c9-f5a048d6500d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/fusedesk/trunk/fusedesk.php#L516"}, {"url": "https://wordpress.org/plugins/fusedesk/#developers"}], "descriptions": [{"lang": "en", "value": "The FuseDesk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018successredirect\u2019 parameter in all versions up to, and including, 6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-04-24T08:23:50.608Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3832", "state": "PUBLISHED", "dateUpdated": "2025-04-24T13:53:02.572Z", "dateReserved": "2025-04-20T15:13:42.937Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-04-24T08:23:50.608Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "FuseDesk", "vendor": "jeremyshapiro", "versions": [{"lessThanOrEqual": "6.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The FuseDesk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018successredirect\u2019 parameter in all versions up to, and including, 6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento FuseDesk para WordPress es vulnerable a Cross-Site Scripting almacenado a trav\u00e9s del par\u00e1metro 'successredirect' en todas las versiones hasta la 6.7 incluida, debido a una depuraci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts arbitrarios en p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-3832", "lastModified": "2026-06-17T09:20:46.050", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-3832", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-04-24T13:52:45.469395Z", "version": "2.0.3"}}]}, "published": "2025-04-24T09:15:32.250", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/fusedesk/trunk/fusedesk.php#L516"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3282801/"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/fusedesk/#developers"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/baf12413-eb45-44c3-a6c9-f5a048d6500d?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T23:10:35.128265+00:00", "value": {"mitigation_remediation": ["Upgrade to the latest FuseDesk version (6.8 or newer) to remove the stored XSS vulnerability.", "If an upgrade is not possible, disable or remove the successredirect feature so that the parameter cannot store malicious code.", "Restrict Contributor or higher roles from editing plugin settings, or further limit these privileges to trusted administrators.", "As a best practice, ensure that all input from users is properly sanitized and escaped before rendering to prevent XSS."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting (XSS)"}, "threat_synthesis": {"affected_systems": "Affected products are all releases of the FuseDesk WordPress plugin up to and including version\u202f6.7, developed by Jeremy Shapiro. Users running any of these versions, regardless of PHP version or host environment, are at risk. The bug exists in the plugin's core PHP file handling successredirect, and therefore any site that has the plugin installed and allows contributor-level edits can be compromised.", "description_and_impact": "The FuseDesk plugin for WordPress contains a stored XSS flaw that allows authenticated users with Contributor or higher privileges to inject JavaScript via the successredirect parameter. The input is neither cleaned nor escaped, meaning that the attacker can embed scripts that will run when any user views a page containing the malicious redirect. This vulnerability can be used to steal session cookies, deface content, or perform phishing attacks by executing arbitrary code in the victim's browser. The weakness aligns with CWE\u201179, which describes malicious input delivered inline.", "risk_and_exploitability": "The CVSS base score of 6.4 indicates moderate severity, and the EPSS score of less than 1% suggests low probability of exploitation in the wild. It is not yet listed in the CISA KEV catalog. Exploitation requires having authenticated access at the Contributor level or higher within the WordPress site, then submitting a crafted successredirect value through the plugin's settings. Because the input is stored, the malicious code persists until the setting is removed or the plugin is upgraded. Attackers could use the injected scripts to perform social engineering or steal data from unsuspecting users."}}}}, "created": "2025-06-23T19:32:00.152952+00:00", "updated": "2026-04-20T23:15:06.308657+00:00", "vendors": ["jeremyshapiro", "jeremyshapiro$PRODUCT$fusedesk"]}