CVE-2026-2425 describes a reflected Cross-Site Scripting vulnerability in the hiWeb Migration Simple plugin for WordPress. The issue exists in the handling of the 'new_domain' parameter, which is not properly sanitized or escaped before being included in web pages. This allows an unauthenticated attacker to craft a URL that, when visited by an administrator, executes arbitrary JavaScript code in the context of the administrator's session. The vulnerability affects all versions up to and including 2.0.0.1. No official patch or remediation level has been published as of the data provided.

Successful exploitation can lead to limited confidentiality and integrity impacts by executing arbitrary scripts in the context of an administrator's browser session. This may allow theft of session cookies or other sensitive information accessible to the administrator, but does not directly impact availability. The CVSS 3.1 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking on untrusted links containing the 'new_domain' parameter in the hiWeb Migration Simple plugin interface. Monitoring for updates from the vendor or plugin author is recommended to apply any official fixes once released.