CVE-2025-67960: WorkScout-Core Reflected XSS Vulnerability

CVE-2025-67960 Overview

CVE-2025-67960 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the WorkScout-Core WordPress plugin developed by purethemes. The vulnerability stems from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that execute in the context of a victim's browser session.

Critical Impact

Attackers can exploit this Reflected XSS vulnerability to execute arbitrary JavaScript code in the browsers of users who click on a maliciously crafted link, potentially leading to session hijacking, credential theft, or malicious redirects.

Affected Products

• WorkScout-Core WordPress Plugin version 1.7.06 and earlier
• WordPress sites running vulnerable versions of the workscout-core plugin

Discovery Timeline

• 2026-01-22 - CVE CVE-2025-67960 published to NVD
• 2026-01-22 - Last updated in NVD database

Technical Details for CVE-2025-67960

Vulnerability Analysis

This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The WorkScout-Core plugin fails to properly sanitize user-supplied input before reflecting it back in the HTTP response, creating a Reflected XSS attack surface.

In Reflected XSS attacks, the malicious payload is delivered through a crafted URL or form submission. When a victim clicks the malicious link, the unsanitized input is processed by the server and returned in the response, where it executes as JavaScript in the victim's browser context. This occurs because the plugin does not adequately validate, sanitize, or encode user input before including it in dynamically generated web content.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and output encoding within the WorkScout-Core plugin. User-controlled data is incorporated into the rendered page without proper sanitization, allowing HTML and JavaScript injection. WordPress plugins that handle user input for job board functionality, such as search queries or form fields, are particularly susceptible to this class of vulnerability when proper escaping functions like esc_html(), esc_attr(), or wp_kses() are not consistently applied.

Attack Vector

The attack requires user interaction - specifically, a victim must click on a maliciously crafted link containing the XSS payload. Attackers typically distribute these links through phishing emails, social engineering, or by embedding them in compromised websites. Once clicked, the malicious script executes with the privileges of the authenticated user, potentially enabling:

• Session cookie theft and account takeover
• Keylogging of sensitive input fields
• Defacement of the page content
• Redirection to phishing sites
• Execution of actions on behalf of the victim

The vulnerability can be exploited remotely without authentication, though it does require the victim to interact with the malicious link.

Detection Methods for CVE-2025-67960

Indicators of Compromise

• Unusual URL parameters containing JavaScript code or HTML tags in server access logs
• Suspicious GET requests to WorkScout-Core plugin endpoints with encoded script payloads
• User reports of unexpected browser behavior or redirects when visiting the site
• Web Application Firewall (WAF) alerts for XSS patterns targeting plugin URLs

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block common XSS payloads in request parameters
• Implement Content Security Policy (CSP) headers to restrict inline script execution and report violations
• Enable detailed logging for the WorkScout-Core plugin endpoints and monitor for malformed requests
• Configure intrusion detection systems (IDS) to alert on XSS signature patterns

Monitoring Recommendations

• Review server access logs regularly for requests containing script tags, event handlers, or encoded payloads
• Monitor CSP violation reports for attempted inline script execution
• Set up alerts for anomalous traffic patterns to plugin-related URLs
• Implement browser-side XSS auditor logging where supported

How to Mitigate CVE-2025-67960

Immediate Actions Required

• Update the WorkScout-Core plugin to a patched version as soon as one becomes available from purethemes
• Implement WAF rules to block known XSS attack patterns targeting the vulnerable endpoints
• Apply Content Security Policy headers to reduce the impact of potential XSS exploitation
• Audit other installed WordPress plugins for similar input validation issues

Patch Information

This vulnerability affects WorkScout-Core versions through 1.7.06 and earlier. Users should monitor the Patchstack WordPress Vulnerability Report for patch availability and update instructions from the plugin vendor. Once a patched version is released, update immediately through the WordPress admin dashboard or by manually downloading the latest version from the vendor.

Workarounds

• Implement a Web Application Firewall with XSS protection rules as a temporary mitigation layer
• Add strict Content Security Policy headers to prevent inline script execution: script-src 'self'
• Consider temporarily disabling the WorkScout-Core plugin if it is not critical to site operations until a patch is available
• Restrict access to vulnerable endpoints using server-level access controls if specific vulnerable URLs are identified

# Example Content Security Policy header configuration for Apache
# Add to .htaccess or virtual host configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self';"

# Example for Nginx configuration
# Add to server block
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self';";