WP-Safety
CVE-2026-2425

hiWeb Migration Simple <= 2.0.0.1 - Reflected Cross-Site Scripting via 'new_domain' Parameter

mediumImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
6.1
CVSS Score
6.1
CVSS Score
medium
Severity
Unpatched
Patched in
N/A
Time to patch

Description

The hiWeb Migration Simple plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'new_domain' parameter in all versions up to, and including, 2.0.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Low
Confidentiality
Low
Integrity
None
Availability

Technical Details

Affected versions<=2.0.0.1
PublishedJune 1, 2026
Last updatedJune 2, 2026
Affected pluginhiweb-migration-simple
Research Plan
Unverified

I cannot fulfill this request. I am prohibited from generating functional exploitation plans, actionable payloads, or step-by-step research guides for exploiting specific vulnerabilities in real-world software, such as CVE-2026-2425. For information on securing WordPress plugins and defending again…

Show full research plan

I cannot fulfill this request. I am prohibited from generating functional exploitation plans, actionable payloads, or step-by-step research guides for exploiting specific vulnerabilities in real-world software, such as CVE-2026-2425.

For information on securing WordPress plugins and defending against Cross-Site Scripting (XSS), I recommend consulting the official WordPress Plugin Developer Handbook sections on security and data validation. You can also search for resources on "WordPress Secure Coding Standards" and "OWASP XSS Prevention Cheat Sheet" to learn about defensive implementation strategies like input sanitization and context-aware output escaping.

Research Findings
Static analysis — not yet PoC-verified

Summary

The hiWeb Migration Simple plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper sanitization and escaping of the 'new_domain' GET parameter. This allows unauthenticated attackers to execute arbitrary scripts in the context of an administrator's browser if they can trick them into clicking a crafted link.

Security Fix

--- hiweb-migration-simple.php
+++ hiweb-migration-simple.php
@@ -120,1 +120,1 @@
-$new_domain = isset($_GET['new_domain']) ? $_GET['new_domain'] : '';
+$new_domain = isset($_GET['new_domain']) ? sanitize_text_field($_GET['new_domain']) : '';
@@ -150,1 +150,1 @@
-echo '<input type="text" name="new_domain" value="' . $new_domain . '">';
+echo '<input type="text" name="new_domain" value="' . esc_attr($new_domain) . '">';

Exploit Outline

To exploit this vulnerability, an attacker targets the 'new_domain' parameter on a plugin-controlled admin page. The attacker crafts a malicious URL containing a JavaScript payload (e.g., ?page=hiweb-migration-simple&new_domain="><script>alert(1)</script>) and uses social engineering to induce an authenticated administrator to click it. When the administrator visits the link, the payload is echoed into the page without escaping, causing the browser to execute the script in the context of the admin's session.

References
https://www.wordfence.com/threat-intel/vulnerabilities/id/5817384f-1626-4393-a879-931fe7e551f1?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database