CVE-2025-9992

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9992", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-04T14:26:57.438Z", "datePublished": "2025-09-18T09:31:28.275Z", "dateUpdated": "2026-04-08T17:13:17.041Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:13:17.041Z"}, "affected": [{"vendor": "nko", "product": "Ghost Kit \u2013 Page Builder Blocks, Motion Effects & Extensions", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.4.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Ghost Kit \u2013 Page Builder Blocks, Motion Effects & Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS field in all versions up to, and including, 3.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Ghost Kit <= 3.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a58bdc25-6171-47d5-bdcc-b4fe89b906f1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3359701/ghostkit/trunk/gutenberg/plugins/custom-code/index.php?old=3037555&old_path=ghostkit%2Ftrunk%2Fgutenberg%2Fplugins%2Fcustom-code%2Findex.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "D.Sim"}], "timeline": [{"time": "2025-09-07T12:25:52.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-09-17T20:48:21.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-18T13:38:52.785339Z", "id": "CVE-2025-9992", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-18T14:03:20.742Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9992", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-18T13:38:52.785339Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-18T13:38:53.702Z"}}], "cna": {"title": "Ghost Kit <= 3.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "D.Sim"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "nko", "product": "Ghost Kit \u2013 Page Builder Blocks, Motion Effects & Extensions", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "3.4.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-07T12:25:52.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-09-17T20:48:21.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a58bdc25-6171-47d5-bdcc-b4fe89b906f1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3359701/ghostkit/trunk/gutenberg/plugins/custom-code/index.php?old=3037555&old_path=ghostkit%2Ftrunk%2Fgutenberg%2Fplugins%2Fcustom-code%2Findex.php"}], "descriptions": [{"lang": "en", "value": "The Ghost Kit \u2013 Page Builder Blocks, Motion Effects & Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS field in all versions up to, and including, 3.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-09-18T09:31:28.275Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9992", "state": "PUBLISHED", "dateUpdated": "2025-09-18T14:03:20.742Z", "dateReserved": "2025-09-04T14:26:57.438Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-18T09:31:28.275Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Ghost Kit \u2013 Page Builder Blocks, Motion Effects & Extensions", "vendor": "nko", "versions": [{"lessThanOrEqual": "3.4.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Ghost Kit \u2013 Page Builder Blocks, Motion Effects & Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS field in all versions up to, and including, 3.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2025-9992", "lastModified": "2026-06-17T10:10:13.087", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9992", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-18T13:38:52.785339Z", "version": "2.0.3"}}]}, "published": "2025-09-18T10:15:35.777", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3359701/ghostkit/trunk/gutenberg/plugins/custom-code/index.php?old=3037555&old_path=ghostkit%2Ftrunk%2Fgutenberg%2Fplugins%2Fcustom-code%2Findex.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a58bdc25-6171-47d5-bdcc-b4fe89b906f1?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T21:47:13.825595+00:00", "value": {"mitigation_remediation": ["Upgrade Ghost Kit to the latest release (3.4.4 or later), which removes or properly sanitizes the vulnerable custom JavaScript field.", "If an immediate update is not possible, revoke Contributor and higher roles from editing pages with custom JS blocks, or disable the custom JS feature in the plugin settings to block payload injection.", "As a temporary measure, implement a web application firewall rule or enforce a strict content security policy that blocks or escapes script tags entered into the custom JS field."], "summary": {"action": "Patch Now", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "All installations of Ghost Kit \u2013 Page Builder Blocks, Motion Effects & Extensions on WordPress with versions 3.4.3 and earlier are affected. The plugin provides a custom JavaScript field in page blocks that can be edited by contributors and higher roles. Users with WordPress roles of Contributor or higher can inject the payload.", "description_and_impact": "The Ghost Kit plugin for WordPress includes a custom JavaScript field that is not properly sanitized or escaped. As a result, any authenticated user with Contributor-level access or higher can store malicious scripts in this field. When a page containing that field is viewed, the injected scripts execute in the browser of any visitor, enabling a stored cross\u2011site scripting vulnerability.", "risk_and_exploitability": "The CVSS base score of 6.4 indicates a moderate severity vulnerability. The EPSS score is below 1%, signifying a low current exploitation probability. The vulnerability is not present in CISA\u2019s KEV catalog. Because the attack requires authenticated access with Contributor-level permissions, the practical risk depends on the number of users with those roles; if many contributors exist, the likelihood of exploitation increases. Successful exploitation would allow the attacker to run arbitrary scripts in a visitor\u2019s browser."}}}}, "created": "2025-09-18T12:40:58.615059+00:00", "updated": "2026-04-20T22:00:11.181036+00:00", "vendors": ["nko", "nko$PRODUCT$ghost_kit_plugin", "wordpress", "wordpress$PRODUCT$wordpress"]}