Reflected Cross-Site Scripting in hiWeb Migration Simple Plugin for WordPress
CVE-2026-2425

6.1MEDIUM

Key Information:

Vendor

WordPress
Status
Hiweb Migration Simple
Vendor
CVE Published:
2 June 2026

What is CVE-2026-2425?

The hiWeb Migration Simple plugin for WordPress is vulnerable to a Reflected Cross-Site Scripting (XSS) attack through the 'new_domain' parameter. This vulnerability arises from inadequate input sanitization and output escaping, allowing unauthorized users to execute arbitrary scripts on the site. An attacker could exploit this weakness by enticing an administrator to click on a maliciously crafted link, potentially leading to session hijacking, data theft, or further compromises of the WordPress environment.

Affected Version(s)

hiWeb Migration Simple 0 <= 2.0.0.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/hiweb-migratio...
https://plugins.trac.wordpress.org/browser/hiweb-migratio...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

san6051
.