CVE-2025-64225 MEDIUM

CVE-2025-64225: WordPress Stockie Extra plugin <= 1.2.11 - Content Injection vulnerability

Vendor Colabrio
Product Stockie Extra
Weakness CWE-80 · XSS · basic
Published December 18, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in colabrio Stockie Extra stockie-extra allows Code Injection.This issue affects Stockie Extra: from n/a through <= 1.2.11.

Explanation of Vulnerability in Simple Terms

02Summary

Stockie Extra versions 1.2.11 and earlier contain an input validation flaw that allows attackers to modify data integrity and availability without authentication. The vulnerability requires only network access and no user interaction. An attacker can exploit this to corrupt or disable functionality on affected installations.

What an attacker can do

03Attacker Capabilities

Modify or disable site data and functionality without logging in.

Potential impact on your site

04Site Impact

Attackers can corrupt data or disrupt service on your site without needing a user account.

Conditions required to exploit

05Prerequisites

Network access to the affected Stockie Extra installation; no authentication required.

Key dates

06Disclosure timeline

December 18, 2025 CVE published
April 28, 2026 Record updated