CVE-2025-64637: Auros Core XSS Vulnerability Explained

CVE-2025-64637 Overview

CVE-2025-64637 is an unauthenticated content injection vulnerability affecting the Auros Core WordPress plugin in versions up to and including 5.3.1. The flaw allows remote, unauthenticated attackers to inject arbitrary content into affected WordPress installations over the network without user interaction. The issue is categorized under [CWE-80] (Improper Neutralization of Script-Related HTML Tags in a Web Page). Impact is limited to confidentiality, with no direct effect on integrity or availability according to the published CVSS vector.

Critical Impact
Unauthenticated attackers can inject content into vulnerable Auros Core plugin instances, enabling potential information disclosure and downstream phishing or social engineering attacks against site visitors.

Affected Products

Auros Core WordPress plugin versions <= 5.3.1
WordPress sites using the Auros theme ecosystem that bundles Auros Core
Any WordPress installation where the vulnerable plugin is active

Discovery Timeline

2026-06-26 - CVE-2025-64637 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2025-64637

Vulnerability Analysis

The vulnerability resides in the Auros Core WordPress plugin at versions 5.3.1 and earlier. It permits unauthenticated content injection, meaning an attacker does not require credentials or elevated privileges to alter content served by the plugin. The classification under [CWE-80] indicates that HTML tags related to scripting are not properly neutralized during input handling. This class of weakness commonly enables reflected or stored injection of markup into pages rendered by the plugin. The reported EPSS probability is 0.24% (percentile 15.036), reflecting low observed exploitation likelihood at the time of publication.

Root Cause

The root cause is improper neutralization of script-related HTML tags on input processed by the plugin. Input reaching a vulnerable code path is echoed into HTML output without adequate sanitization or output encoding. Because authentication is not enforced on the affected endpoint, any network client can supply the injectable payload. Refer to the Patchstack WordPress Vulnerability Report for the disclosed technical scope.

Attack Vector

Exploitation occurs remotely over the network. An attacker crafts an HTTP request containing HTML markup targeting a vulnerable Auros Core parameter or endpoint. When the injected content is rendered, it appears within the trusted site context. This can be used to alter page content, embed misleading information, or facilitate phishing against site visitors. No user interaction or authentication is required to trigger the flaw.

Detection Methods for CVE-2025-64637

Indicators of Compromise

Unexpected HTML markup, banners, or hyperlinks appearing within pages generated by the Auros Core plugin.
Web server access logs containing requests with HTML tag characters (<, >, %3C, %3E) targeting Auros Core endpoints.
Outbound references from rendered pages to unfamiliar external domains not present in site source content.

Detection Strategies

Inventory WordPress deployments and identify sites running Auros Core <= 5.3.1.
Inspect HTTP request logs for anomalous parameters submitted to plugin routes with markup-like payloads.
Compare rendered page output against known-good baselines to detect injected content.

Monitoring Recommendations

Enable Web Application Firewall (WAF) logging for WordPress endpoints and alert on requests carrying script-related HTML tags.
Monitor plugin file integrity and rendered page hashes for unexpected changes.
Aggregate WordPress access logs into a centralized SIEM for correlation across affected sites.

How to Mitigate CVE-2025-64637

Immediate Actions Required

Identify all WordPress installations running Auros Core <= 5.3.1 and prioritize them for remediation.
Update Auros Core to a fixed version once released by the vendor, as tracked in the Patchstack advisory.
Deploy WAF rules that block requests containing script-related HTML markup targeting the plugin's endpoints.

Patch Information

At time of publication, refer to the Patchstack WordPress Vulnerability Report for the current fixed version and vendor guidance. Apply the vendor-supplied update to versions later than 5.3.1 when available.

Workarounds

Disable the Auros Core plugin until a patched version can be applied.
Restrict access to affected endpoints via network access control lists or WAF rules that filter HTML tag characters.
Enforce output encoding at the theme or reverse-proxy layer to neutralize injected markup in rendered responses.

bash

# Configuration example: WAF rule to block HTML tag injection on Auros Core requests
# ModSecurity example (adjust to your WAF syntax)
SecRule REQUEST_URI "@contains /wp-content/plugins/auros-core/" \
  "phase:2,deny,status:403,id:1006463,\
  chain,msg:'CVE-2025-64637 Auros Core content injection attempt'"
  SecRule ARGS "@rx <[a-zA-Z/!]" "t:none,t:urlDecodeUni"