CVE-2026-2425 is a reflected cross-site scripting vulnerability in the hiWeb Migration Simple WordPress plugin by den-media. The issue exists in all versions up to 2.0.0.1 due to improper neutralization of input in the 'new_domain' parameter. An unauthenticated attacker can craft a malicious URL that, when clicked by an administrator, executes arbitrary JavaScript in the context of the administrator's browser session. This vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability. No official fix or patch has been published yet.

Exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of an administrator's browser session, potentially leading to limited confidentiality and integrity impacts such as session hijacking or unauthorized actions performed with administrator privileges. There is no impact on system availability. The attack requires user interaction (administrator clicking a malicious link) and does not require authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking on untrusted links that could exploit the 'new_domain' parameter in the hiWeb Migration Simple plugin. Monitoring for updates from the vendor den-media is recommended to apply any official patches once released.