Junglewise Threat Intelligence

CVE-2026-2425: hiWeb Migration Simple Reflected XSS in new_domain parameter

CVE-2026-2425 · Severity: medium · CVSS 6.1 · Published 2026-06-02

Executive brief

The hiWeb Migration Simple plugin for WordPress, which helps users migrate website data, contains a security flaw that allows attackers to run malicious scripts in an administrator's browser. By tricking a site administrator into clicking a specially crafted link, an attacker could potentially hijack their session or perform unauthorized actions on the website. This could lead to unauthorized site changes or the theft of sensitive administrative information.

Technical details

The hiWeb Migration Simple plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'new_domain' parameter within the 'force-re-migrate-confirm.php' template. An unauthenticated remote attacker can exploit this by crafting a malicious URL containing a script payload and tricking an authenticated administrator into clicking it. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session, which can be used to bypass same-origin policy protections or perform administrative tasks. The vulnerability exists in all versions up to and including 2.0.0.1.

Affected products

  • hiWeb hiWeb Migration Simple up to, and including, 2.0.0.1

Timeline

  • 2026-06-02: disclosed: Vulnerability published to the CVE list.
  • 2026-06-02: advisory: Wordfence published the vulnerability details.

References