CVE-2025-7400 is a stored cross-site scripting vulnerability in the Featured Image from URL (FIFU) WordPress plugin. It affects all versions up to and including 5.2.7 due to improper neutralization of input in the Featured Image custom fields. Authenticated attackers with Contributor-level permissions or higher can inject malicious scripts that execute in the context of users viewing the compromised pages. The vulnerability was partially addressed in version 5.2.2 but remains exploitable in subsequent versions through 5.2.7. The CVSS 3.1 base score is 6.4, reflecting a network attack vector with low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity with no availability impact.

Successful exploitation allows authenticated users with Contributor or higher privileges to inject and store malicious scripts in post metadata fields. These scripts execute in the browsers of users who view the affected pages, potentially leading to session hijacking, data theft, or other client-side attacks. The vulnerability does not impact availability. The partial fix in version 5.2.2 did not fully resolve the issue, leaving versions up to 5.2.7 vulnerable.

No official patch or full fix is confirmed for versions up to 5.2.7. Users should upgrade to a version later than 5.2.7 if available or apply vendor-provided patches once released. Until then, restrict Contributor-level access to trusted users only and consider disabling or replacing the FIFU plugin to prevent exploitation. Monitor vendor advisories for updates on remediation status. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.