Authentication bypass in TM2 Monitoring v3.04 allows remote attackers to circumvent login controls and access the application, which additionally stores and discloses user credentials in plaintext. Publicly available exploit code exists (POC published by researcher stSLAYER for RT-Systems' TM2), enabling full compromise of confidentiality, integrity, and availability. Not listed in CISA KEV and EPSS probability is low (0.32%), so no confirmed active exploitation despite the critical 9.8 CVSS score.
Unrestricted file upload in the Medcity WordPress theme before version 1.1.9 allows unauthenticated attackers to upload a web shell, leading to complete compromise of the web server. This vulnerability, rated critical with CVSS 10.0 and CWE-434, is not currently listed in CISA KEV, and the EPSS score of 0.06% indicates low probability of widespread exploitation.
Remote code execution in Beplusthemes Alone WordPress theme through version 7.8.3 allows unauthenticated attackers to inject and execute arbitrary code via a code injection vulnerability. With a critical CVSS score of 10.0 and network-based exploitation requiring no privileges or user interaction, this vulnerability enables complete system compromise. EPSS exploitation probability is low (0.06%, 17th percentile), and no public exploit or CISA KEV listing identified at time of analysis.
PHP object injection in UNIVERSAM WordPress plugin through deserialization of untrusted data allows remote unauthenticated attackers to achieve critical impact including remote code execution, complete data compromise, and denial of service. Affects all versions up to and including 9.03. EPSS exploitation probability is relatively low at 0.10% (28th percentile), with no public exploit identified at time of analysis, suggesting a lower immediate real-world risk despite the critical CVSS 9.8 score.
PHP object injection in BoldThemes Addison WordPress theme versions prior to 1.4.8 enables unauthenticated remote attackers to execute arbitrary code through unsafe deserialization. The vulnerability carries a critical CVSS 9.8 score with network-accessible attack vector requiring no privileges or user interaction. No public exploit identified at time of analysis, with EPSS indicating 10th percentile exploitation probability (0.10%), suggesting low observed exploitation likelihood despite high theoretical severity.
PHP object injection in BoldThemes Goldenblatt WordPress theme versions prior to 1.3.0 enables unauthenticated remote attackers to execute arbitrary code through deserialization of untrusted data. The vulnerability scores 9.8 (Critical) with network-exploitable attack vector requiring no privileges or user interaction. EPSS indicates low probability (0.10%, 28th percentile) of active exploitation, and no public exploit or KEV listing identified at time of analysis, suggesting theoretical high severity but currently limited real-world exploitation activity.
PHP object injection in WooCommerce Vehicle Parts Finder plugin versions up to 3.7 enables remote unauthenticated attackers to achieve arbitrary code execution via deserialization of untrusted data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-accessible exploitation without authentication or user interaction. Reported by Patchstack audit team, this represents a critical pre-authentication vulnerability in WordPress e-commerce environments. EPSS data unavailable; not currently listed in CISA KEV, suggesting limited widespread exploitation at time of disclosure.
Unauthenticated remote code execution in TF Woo Product Grid Addon for Elementor versions up to 1.0.1 allows complete site compromise via PHP object injection. The vulnerability stems from insecure deserialization (CWE-502) of untrusted input, exploitable without authentication or user interaction. No
SQL injection in WordPress SMS Alert Order Notifications plugin through version 3.8.5 allows remote unauthenticated attackers to extract sensitive database contents via network-accessible injection points. The vulnerability achieves scope change with high confidentiality impact, enabling cross-boundary data exfiltration from the WordPress database. EPSS data unavailable; not currently listed in CISA KEV, indicating no confirmed widespread active exploitation at time of analysis, though the unauthenticated remote attack vector presents significant risk for WordPress installations using this plugin.
SQL injection in ThemeMove Learts Addons for WordPress prior to version 1.7.5 allows unauthenticated remote attackers to execute arbitrary SQL commands. Exploitation can exfiltrate sensitive database contents (C:H) and, to a limited degree, affect data availability (A:L). The vulnerability currently has no known public exploit, and EPSS predicts very low exploitation probability (0.04%).
Blind SQL injection in Crocoblock JetSearch plugin (WordPress) versions up to 3.5.10 allows unauthenticated remote attackers to extract database contents via crafted search queries. The vulnerability carries a critical CVSS 9.3 score due to network-based exploitation requiring no authentication or user interaction, though EPSS exploitation probability remains low at 0.04% (12th percentile), and no public exploit identified at time of analysis. The flaw enables data exfiltration from WordPress databases hosting sites using the vulnerable search plugin.
Arbitrary file upload in the WordPress Zippy plugin (<=1.7.0) allows authenticated administrators to upload malicious files, leading to remote code execution and full server compromise. No public exploit or active exploitation has been identified at time of analysis. EPSS score of 0.06% indicates low likelihood of widespread exploitation.
Remote code execution in the s2Member WordPress plugin (≤ version 250905) allows unauthenticated attackers to inject and execute arbitrary PHP code, potentially leading to full site compromise. The vulnerability has a CVSS score of 9.0 but a very low EPSS exploitation probability (0.06%) and is not listed in CISA KEV; no public exploit is known at the time of analysis.
Privilege escalation in FantasticPlugins SUMO Memberships for WooCommerce (versions ≤7.8.0) allows authenticated users with low-level privileges to elevate permissions and gain unauthorized high-level access to WordPress site functions. The vulnerability stems from incorrect privilege assignment (CWE-266), enabling attackers to bypass intended access controls. With CVSS 8.8 (High) severity, the flaw permits complete compromise of confidentiality, integrity, and availability. EPSS probability is low (0.06%, 17th percentile), and no public exploit identified at time of analysis, though Patchstack has published advisory details.
Privilege escalation in N-Media Simple User Registration (WordPress plugin) through version 6.8 allows authenticated low-privilege users to elevate their access to administrator-level permissions via incorrect privilege assignment. With EPSS at 0.06% (17th percentile) and no public exploit identified at time of analysis, real-world exploitation risk remains low despite the high CVSS score. The vulnerability requires low-privilege authentication (PR:L) but has low attack complexity (AC:L) and no user interaction (UI:N), making it straightforward to exploit once an attacker has basic user credentials.
Password recovery exploitation in WordPress Emails Catch All plugin <=3.5.3 allows low-privileged authenticated attackers to reset any user’s password via an authentication bypass using an alternate channel. Successful exploitation grants full access to the target WordPress site, including data theft and site takeover. While rated High severity, the EPSS signal indicates very low real-world exploitation probability and no active exploitation is confirmed at this time.
Arbitrary file deletion in ThimPress WP Pipes plugin for WordPress (up to version 1.4.3) allows unauthenticated attackers to delete arbitrary files on the server via path traversal. This network-based, high-severity vulnerability (CVSS 8.6) has a low EPSS exploitation probability (0.09%) and is not listed in CISA KEV, with no known public exploit code at time of analysis.
Unauthenticated attackers can bypass access controls in the MultiVendorX WooCommerce plugin (versions up to 4.2.23), leading to unauthorized modification of plugin functionality with high integrity impact. The vulnerability has a low EPSS score (0.06%) and no known public exploit or active exploitation at time of analysis.
2-3 sentence plain-language ...
We need to analyze CVE-2025-48091 and produce a comprehensive JSON. The input provides description, CVSS, CWE, EPSS, tags, references. No KEV status given, no POC info. Patch available? Patchstack reference might have info, but we need to infer. Product: "AnyComment" WordPress plugin, developer: Alexander AnyComment. Version: from n/a through <= 0.3.6. CVSS: 8.5, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L (High confidentiality, Low availability on scope change). CWE-89 SQLi. EPSS: 0.03% (low). Tags: SQLi. No KEV, no mention of active exploitation or POC. So exploitation status: no public exploit identified. Patch status: Patchstack advisory likely indicates a fix. But no version given beyond affected <=0.3.6. Typically, Patchstack will recommend update to latest version, which is presumably >0.3.6. So we can say vendor-released patch available (update plugin). The description says "through <= 0.3.6" so patch would be in a version higher than that. We'll state: "Vendor-released patch: version >0.3.6" but need exact? Not given. So we can say update to the latest version. I'll note that exact fixed version not provided in the data, but updating to the latest available version is recommended. Now, product_name: 1-3 words only. "AnyComment" (the plugin). So "AnyComment" is fine. "AnyComment WordPress Plugin" could be three words. I'll use "AnyComment" to be precise as per the description: "Alexander AnyComment anycomment". So product is "AnyComment". So product_name: "AnyComment". summary: 2-3 sentences. Not paraphrase. Start with impact verb. It's SQL injection in AnyComment WordPress plugin versions up to 0.3.6, allowing authenticated attacker with low privileges to extract sensitive data from the database and cause limited availability impact. Since PR:L, attack requires authentication. I'll synthesize: "SQL injection vulnerability in the AnyComment WordPress plugin (<=0.3.6) allows authenticated attackers with low privileges to extract confidential data from the database and cause partial denial of service via crafted SQL queries..." Must mention if POC exists or active exploitation. No KEV, no POC info. I'll say "no public exploit identified at time of analysis." EPSS 0.03% is low, so not widely exploited. Patch available via update. So summary: "Authenticated SQL injection in the AnyComment WordPress plugin (≤0.3.6) allows low-privilege attackers to extract sensitive database information and cause limited availability impact. No public exploit is currently known, but updating to a version >0.3.6 mitigates the risk." That's okay. technical_context: CWE-89 SQLi. CPE? Not provided, but we can note that it's a WordPress plugin. So technology: SQL injection due to improper neutralization of special elements. The plugin likely interacts with the WordPress database. Mention the root cause is likely unsanitized user input used in SQL queries. Not much else. risk_assessment: CVSS 8.5, AV:N, AC:L, PR:L, UI:N, S:C, C:H, I:N, A:L. So network, low complexity, low privilege, no user interaction, scope changed, high confidentiality impact, no integrity, low availability. With EPSS 0.03% (low probability of exploitation in next 30 days), no active exploitation known. POC unknown. No KEV. So risk is moderate: a credible SQLi that could expose data, but requires authentication (any subscriber-level user could do it). The EPSS is low, but that may be because it's a niche plugin. So risk is not extremely high. I'll contrast: "CVSS indicates an easily exploitable, network-based SQLi that yields full data exposure, but EPSS suggests a low likelihood of widespread exploitation, likely due to the plugin's limited footprint. No active exploitation or public exploit reported." That's good. affected_products: Mention AnyComment plugin for WordPress, versions from n/a through <=0.3.6. No CPE given but that's okay. Reference the Patchstack URL. I'll write: "The AnyComment WordPress plugin (developed by Alexander AnyComment) versions up to and including 0.3.6 are affected. The vendor advisory is available at Patchstack." I'll include the URL inline but not as link in text? It's okay as plain text. remediation: Update to a version beyond 0.3.6. The latest version from WordPress plugin repository is presumably 0.3.7+ or removed. The Patchstack reference might have details. I'll suggest updating to the latest available version (or remove the plugin if no fix). Since the description says through <=0.3.6, the fix version is likely 0.3.7 or the plugin is closed. Patchstack would state that. I'll check reference: it's a Patchstack database entry for the plugin. No fixed version is explicitly listed in the input, but typically Patchstack will note that a fix is available and recommend updating. So I'll write: "Upgrade the AnyComment plugin to version 0.3.7 or the latest available version, which contains patches for this SQL injection. If no update is available, consider disabling or removing the plugin. As a temporary mitigation, restrict database permissions and implement WAF rules to block malicious SQL payloads." But be careful: I shouldn't invent version 0.3.7 unless confirmed. The input says "through <= 0.3.6" so a fix would be in version >0.3.6. I'll state: "Update to a version greater than 0.3.6; the exact patched version was not specified in the available data, but all versions >0.3.6 are assumed to be fixed per the Patchstack advisory." That's cautious. exploit_scenario: An authenticated attacker with subscriber-level access crafts a malicious SQL payload in a plugin input field (like comments or any comment parameter) that is improperly sanitized, leading to SQL execution against the WordPress database, enabling extraction of user credentials or other sensitive data. 2-3 sentences. exploitation_conditions: The description says "Improper Neutralization of Special Elements used in an SQL Command". It doesn't specify any non-default configuration. So likely the condition is that the attacker is authenticated with low privileges (as per CVSS PR:L). So the specific condition: "Attacker must be authenticated to the WordPress site with at least subscriber-level privileges. No other non-default configuration is required; the SQL injection is exploitable via the plugin's comment functionality." That's concrete. Not generic. attack_chain: Recon → Authenticate as low-privilege user → Deliver crafted SQL payload via plugin input → Exploit SQL injection to extract data → Impact: data breach and limited availability disruption. I'll condense to steps with arrow: "Authenticate as low-privilege user on WordPress site → Submit crafted SQL payload in AnyComment input field → SQL query executed with elevated privileges due to unsanitized input → Extract sensitive database tables" etc. I'll make 5-6 steps. 6-step: Recon → Delivery → Exploit → Install → C2 → Execute → Impact. But we can adapt. I'll do: "Authenticate as low-privilege user → Submit crafted HTTP request with SQL injection payload to AnyComment endpoint → Unsanitized input embedded in SQL query → Database executes attacker-controlled SQL → Extract confidential data from WordPress database → Cause partial denial-of-service through heavy queries". That's 6 steps. confidence_notes: What is confirmed: Vulnerability described by NVD and Patchstack, CVSS vector assigned by Patchstack (or NVD). Exploit status: no public exploit or active exploitation reported. Patch availability: updating beyond 0.3.6 resolves (Patchstack advisory implies fix). No independent confirmation of patch version. So I'll state: "The vulnerability is confirmed by Patchstack; no public exploit code or active exploitation was identified at time of analysis. The exact patched version is not explicitly disclosed, but all versions beyond 0.3.6 are indicated as fixed." prevalence: The plugin "AnyComment" is a WordPress plugin. How widely used? Niche. Probably low usage. I'll say "low" because it's not a top-tier plugin. Justify: "niche WordPress plugin with limited install base". So prevalence: low, prevalence_basis: "niche WordPress plugin with limited install base". assessed_cvss_vector: My own independent CVSS 3.1 base vector. Need to ensure it's grounded. The existing vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. That seems appropriate because SQLi over network, low complexity, low privileges, no user interaction, scope changed (accessing database may be separate system?), confidentiality high, integrity none (since no data modification via injection? SQLi can modify but the specific impact may not include data integrity. The CVE says "SQL injection" but only confidentiality and availability are impacted. That might be due to the nature of the SQLi, perhaps only UNION-based or blind extraction without write permissions. So I'll keep I:N. Availability low like heavy query. So I'll use that vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. That's reasonable and consistent. So assessed_cvss_vector: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L". rationale: "Network-accessible SQLi with low attack complexity; requires low-privilege authentication and no user interaction; scope change allows high confidentiality impact." assessed_cvss40_vector: Convert to CVSS 4.0. CVSS v4.0 base vector: AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N? Wait, CVSS 4.0 splits impact into vulnerable system (VC, VI, VA) and subsequent system (SC, SI, SA). With scope changed (S:C in 3.1), in 4.0, the vulnerable system is the plugin/WordPress, and the subsequent system is the database. The impact on vulnerable system: C:H (confidentiality) and A:L (availability) but? The description says "SQL injection" leads to impact on confidentiality (likely extraction) and availability (possible via denial of service). No integrity impact. So for vulnerable system, if the SQLi allows data access, it might be reading database data, which could be considered confidentiality impact on the vulnerable system (the WordPress application). But is the database part of the vulnerable system? In 4.0, the vulnerable system is the one directly exploited. Usually, with SQLi, the vulnerable system is the web application, and the database is a separate system, so scope change indicates impact on both. So we'd have VC:H (confidentiality impact on the vulnerable system, i.e., the web application can exfiltrate data from its own context? Actually, the web app might be used to read data from DB, but the data belongs to DB. In CVSS 4.0, if the vulnerable component is the web application and the attack allows reading data from a backend database (subsequent system), then the vulnerable component's confidentiality might be low (N) while the subsequent system's confidentiality is high. However, the 3.1 vector had C:H and scope changed, meaning the vulnerability impacts a component where the vulnerable component is the one with the vulnerability, and the impact is on a different component. Typically, in SQLi, the vulnerable component is the web app, and the impacted component is the database. So S:C, C:H means confidentiality impact on the impacted component (database) is high, while the vulnerable component might have no confidentiality impact. But in CVSS 3.1, when scope changed, you set the confidentiality impact to what the attacker can get from the impacted component. So C:H is on the database. So in 4.0, we need to map it: Vulnerable system (the web app): VC (confidentiality), VI, VA. Since the vulnerability doesn't directly compromise confidential data in the web app itself, VC:N. VI:N (no integrity impact on web app), VA:L? Wait, availability low might be on the web app or database. The CVE says A:L, so an availability impact on the impacted component. So in 4.0, we might have for vulnerable system: VA:N (since the web app isn't impaired), and subsequent system (database): SA:L. That's more consistent. So I'll assign: AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:L. That means the vulnerable system has no confidentiality, integrity, availability impact; the subsequent system (database) has high confidentiality impact and low availability impact
Local File Inclusion in ThemeMove Businext theme versions prior to 2.4.4 allows unauthenticated attackers to include arbitrary local PHP files, potentially leading to information disclosure or remote code execution. Exploitation is complex and requires the ability to place PHP code in a file accessible by the server. No known public exploit or active exploitation has been identified at this time, and EPSS estimates a low probability of exploitation.
Local file inclusion in the SmilePure WordPress theme before version 1.8.5 allows unauthenticated remote attackers to read arbitrary files on the server, leading to sensitive information disclosure such as database credentials. Exploitation requires high complexity and no exploit code or active attacks have been observed.
We are tasked with producing a comprehensive JSON analysis. The input provides CVE ID, description, CVSS vector, CWE, and some multi-source intel: EPSS score (0.07%, percentile 22%), tags "Path Traversal", and a reference to Patchstack. There is no KEV listing, no explicit POC availability, no patch version stated beyond "through <= 3.3.5", meaning affected versions up to 3.3.5. The reference URL is a Patchstack advisory. Let's read the URL content? Not provided directly but the advisory likely describes the vulnerability. Since we only have the description, we need to synthesize using all data: CVE description, CVSS vector, EPSS, tags, reference. There is no CPE string, but the product is "Workreap (theme's plugin) workreap" from AmentoTech. It is a WordPress theme plugin. The CVSS vector: AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. So attack vector Network, low complexity, privileges required Low, no user interaction, scope changed, confidentiality none, integrity none, availability high. That suggests a path traversal leading to availability impact (file deletion maybe? The Patchstack URL says "arbitrary-file-deletion-vulnerability", confirming impact: arbitrary file deletion via path traversal. The CWE-22 path traversal. Now, we need to produce fields. Let's start. product_name: "Workreap" (1-3 words, the specific product name). So "Workreap" is the theme's plugin. Could be "Workreap plugin" but only 1-3 words, so "Workreap". If "Workreap (theme's plugin)" that's more than 3 words, but "Workreap" alone is fine. summary: synthesize: Path traversal vulnerability in Workreap plugin for WordPress (theme's plugin) through version 3.3.5 allows authenticated attackers (PR:L) to delete arbitrary files on the server, causing denial of service (A:H). No confidentiality or integrity impact, but high availability impact. EPSS 0.07% indicates low exploit likelihood. No KEV listing. Not mention of active exploitation. So: "Authenticated attackers can exploit a path traversal vulnerability in Workreap plugin versions <= 3.3.5 to delete arbitrary files, resulting in denial of service. The vulnerability has a CVSS 3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H), indicating network-based low-complexity attack with no user interaction beyond authentication. EPSS score of 0.07% suggests low probability of exploitation in the wild, and no evidence of active exploitation is available." That's a good summary. technical_context: Mention underlying technology: WordPress plugin, path traversal due to improper sanitization of user-supplied input in file operations. CWE-22. Product Workreap by AmentoTech, a theme plugin. CPE data not provided, but we can infer CPES: likely cpe:2.3:a:amentotech:workreap:... The reference Patchstack advisory shows the plugin slug "workreap". The vulnerability leads to arbitrary file deletion. The affected product is the Workreap plugin. So technical_context: "The Workreap plugin is a WordPress theme companion plugin that likely handles file uploads or paths, where insufficient sanitization allows a path traversal attack (CWE-22). An attacker with low-privilege user access can manipulate file paths to traverse directories, potentially deleting files outside the intended directory. The CVSS vector confirms network attack vector, low attack complexity, and no user interaction required after authentication." risk_assessment: Use CVSS vector: Network, low complexity, low privileges, no UI, scope changed, no CIA except A:H. So a low-privileged (e.g., subscriber) user can cause denial of service by deleting files. EPSS 0.07% (low probability). No KEV, no POC mentioned. SSVC decision might be: exploitation none, automatable yes (network, low complexity), technical impact partial (availability only), so priority might be lower. So risk is moderate: high CVSS but low EPSS suggests while the impact is serious, exploitation is not widespread or likely. "Risk is moderate: CVSS 7.7 indicates a critical availability impact, but the EPSS score of 0.07% (22nd percentile) suggests very low probability of real-world exploitation. No active exploitation or publicly available exploit code is reported. The attack requires authenticated access (low privileges), which reduces the attack surface slightly. However, the low complexity and network vector make it automatable once authenticated." affected_products: "Workreap plugin for WordPress versions n/a through 3.3.5. The vendor is AmentoTech. For details, see Patchstack advisory: https://patchstack.com/database/Wordpress/Plugin/workreap/vulnerability/wordpress-workreap-theme-s-plugin-plugin-3-3-5-arbitrary-file-deletion-vulnerability?_s_id=cve" That's concise. remediation: There's no patch information in input other than "through <= 3.3.5", implying that versions up to 3.3.5 are affected. Typically, a fix would be in a later version, but the advisory might not specify. The Patchstack URL might have remediation. Since we don't have the content, we must rely on the description: "through <=3.3.5" so fix likely in version after 3.3.5. We should state: "Upgrade Workreap plugin to a patched version later than 3.3.5. If no update is available, consider disabling the plugin or restricting file access permissions on the server to limit impact. Monitor the vendor’s release page and Patchstack advisory for updates." However, we can't confirm a specific version. So: "No patched version is specified in the available data; however, versions up to 3.3.5 are affected. Immediately update to a version newer than 3.3.5 when released, or disable the plugin until a fix is available. As a compensating control, restrict the web server process's write permissions to critical directories, though this may affect plugin functionality. Refer to the Patchstack advisory for official remediation." exploit_scenario: "An authenticated user, such as a subscriber, sends a malicious request with a crafted file path parameter to a vulnerable endpoint in the Workreap plugin, leveraging path traversal sequences (e.g., "../") to specify a target file outside the intended directory. The application processes the path without proper sanitization, resulting in deletion of that file and causing service disruption." That's realistic. No POC noted, so no mention. exploitation_conditions: Need to extract specific conditions from description. The description says: "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AmentoTech Workreap (theme's plugin) workreap allows Path Traversal." So the vulnerability exists when the plugin processes file paths (likely during file deletion operations). The CVSS says PR:L, so attacker must have low privileges (authenticated as subscriber or similar). No user interaction. So conditions: "The attacker must have a low-privilege user account on the WordPress site (authenticated). The Workreap plugin must be active and the vulnerable endpoint accessible. No special feature needs to be enabled beyond the plugin's normal operation. Exploitation does not require user interaction." That's it. attack_chain: We'll craft a chain: "Authenticate to WordPress as low-privilege user → Craft malicious request with path traversal payload targeting sensitive file → Send request to vulnerable Workreap endpoint → Plugin processes path without sanitization → File at traversed path is deleted → Service disruption (denial of service due to missing critical file)." confidence_notes: "Exploitation conditions derived from CVSS vector (PR:L) and Patchstack advisory. No public exploit availability confirmed. No CISA KEV listing. EPSS suggests low exploitation likelihood. Patch availability not specified in the input; update guidance inferred from affected version range." prevalence: "medium" - Workreap is a WordPress theme plugin, probably used by some websites but not as ubiquitous as core plugins. Could be low? But I'd estimate medium: WordPress plugin usage is common, but it's a theme-specific plugin, not a general-purpose plugin. So "low" might be more accurate. However, we need to be real: theme companion plugins can have decent install base. But without stats, I'd say "medium" is safe. Prevalence basis: "WordPress theme companion plugin used with Workreap theme". So "medium" because it's not a top plugin but tied to a commercial theme. I'll put prevalence "low"? Let's see input: no install numbers. I'll gauge: "AmentoTech Workreap" theme's plugin. ThemeForest maybe. I'll check: "workreap" theme on ThemeForest has ~3,000 sales? That might be low. So prevalence "low". Prevalence basis: "commercial WordPress theme plugin with limited install base". So prevalence: "low". If unknown, we could say unknown, but we can estimate. I'll go with "low". Prevalence basis: "specialized commercial theme companion plugin, not widely deployed". assessed_cvss_vector: My own independent CVSS. The given vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. I need to output my own assessment. It seems accurate: network attack vector, low complexity, privileges low, no user interaction, scope changed because the vulnerable component is the plugin and the impact is on the file system? Actually, scope changed because the vulnerable component (plugin) impacts a resource outside its scope (other files on server). S:C is appropriate. Impact: confidentiality none (C:N), integrity none (I:N), availability high (A:H). So I'd output the same vector. Rationale: "Authenticated low-privilege user can delete arbitrary files, causing availability impact; no confidentiality or integrity loss." So vector: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H". For CVSS 4.0: I need to map. CVSS 4.0 base vector: AV:N, AC:L, AT:N (no attack requirement specified), PR:L, UI:N, VC:N, VI:N, VA:H (vulnerable system availability high), SC:N, SI:N, SA:N (subsequent system? The scope changed in 3.1 is handled differently in 4.0. In CVSS 4.0, if there is a scope change, the impact to the subsequent system (the one whose security relies on the vulnerable component) is denoted by SC, SI, SA. The vulnerable system itself is the plugin component, which has VC, VI, VA. Since the vulnerability only deletes files (affect the system's availability), VA:H. The subsequent system (the filesystem) is the same host, but the scope is changed: the vulnerable component is the plugin and the impact is on the server files. In CVSS 4.0, scope is not explicitly captured the same way; instead, we have vulnerable system metrics and subsequent system metrics. The attacker's action affects the vulnerable component with VA:H (availability of the plugin? Actually, the file deletion impacts the server's availability, not the plugin's availability. But CVSS 4.0 definition: "Vulnerable System metrics refer to the system that contains the vulnerable component and is most directly impacted by the vulnerability." The plugin is the vulnerable component, and the system hosting it is the vulnerable system. The availability impact on that system is high (server files deleted, causing DoS). So VC:N, VI:N, VA:H. No subsequent system impact because the vulnerability directly affects the vulnerable system. So SC, SI, SA are N. So CVSS 4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. That seems right. The 3.1 scope change translates to a CVSS 4.0 situation where the vulnerable system is the server (the component is the plugin), and there is no subsequent system. Actually, in 3.1 scope changed because the component (plugin) is separate from the impacted resource (files). In 4.0, that's captured by the fact that the vulnerable system is the server, and the vulnerability impacts the server's availability. So no subsequent system. So vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. Good. assessed_cvss_rationale: "Authenticated low-privileged network attack requires no user interaction, targeting file deletion causing high availability impact, no confidentiality or integrity loss." assessed_cvss40_vector: as above. Now, all fields must be plain text
Arbitrary file deletion in the Taskbot WordPress plugin through version 6.4 allows authenticated low-privilege users to delete critical files via path traversal, leading to denial of service. No active exploitation or public exploit is reported; EPSS score is low (0.07%).
Arbitrary file deletion in PT Luxa Addons WordPress plugin versions ≤1.2.2 allows authenticated attackers with low privileges (e.g., subscriber) to delete arbitrary files on the server via path traversal, leading to denial of service. The vulnerability is remotely exploitable but requires an authenticated account; no public exploit or active exploitation has been observed at this time, and EPSS indicates a very low exploitation probability (0.06%).
SQL injection in the WooCommerce Advanced Coupons plugin (<= 4.6.8) allows authenticated attackers with administrator privileges to execute arbitrary SQL queries, potentially extracting sensitive data from the database. Exploitation requires high-level access rights, and no active exploitation or public exploit has been reported. EPSS score is very low (0.03%), indicating low probability of widespread exploitation.
Local file inclusion in Crocoblock JetReviews plugin versions through 3.0.0 allows authenticated attackers with low-level privileges to read arbitrary files on the WordPress server via PHP file inclusion flaws. With EPSS at 0.13% (33rd percentile), exploitation likelihood is currently low. No active exploitation confirmed (not in CISA KEV), but Patchstack has cataloged the vulnerability indicating professional security research attention. Attackers can access sensitive configuration files, credentials, and potentially chain with other vulnerabilities for code execution.
Local file inclusion in the WoodMart WordPress theme before version 8.3.2 allows authenticated low-privilege users (e.g., subscribers) to include arbitrary PHP files on the server, potentially leading to remote code execution, information disclosure, or complete site compromise. Exploitation requires only low-level access but is of high complexity (CVSS 7.5, EPSS 0.13%), and no public exploit or active exploitation has been observed at the time of analysis.
Unauthenticated information disclosure in the VibeThemes WPLMS WordPress plugin (≤1.9.9.7) allows remote attackers to access restricted functionality and read sensitive data without any interaction or privileges. The vulnerability stems from a missing authorization check, making exploitation trivial, though EPSS indicates a low probability of real-world exploitation at this time.
Local file inclusion in WP Abstracts (wp-abstracts-manuscripts-manager) plugin for WordPress versions ≤ 2.7.4 allows unauthenticated attackers to read arbitrary local files. Exploitation requires user interaction and high attack complexity, potentially leading to full server compromise. The EPSS probability is very low (0.05%), and no active exploitation or public exploit code is currently known.
High integrity impact vulnerability in WordPress Tablesome Table Premium plugin versions <= 1.1.23 allows unauthenticated attackers to modify plugin functionality due to missing authorization checks. An attacker can access features not properly constrained by ACLs, potentially altering table configurations or data. No active exploitation or public exploit code is reported, but the flaw is remotely exploitable with low complexity.
Unauthenticated access to sensitive data in BuddyPress up to version 14.3.4 allows remote attackers to read confidential information due to a missing authorization check. This vulnerability affects the popular WordPress social networking plugin and can be exploited without user interaction. Public exploit code is not known to exist, and EPSS indicates a very low probability (0.04%) of active exploitation.
Code injection in WP Last Modified Info plugin versions ≤1.9.4 allows authenticated attackers with low-level privileges to execute arbitrary code remotely via vulnerable code generation controls. The CVSS 7.4 rating reflects network accessibility, low attack complexity, and scope change enabling cross-boundary impact. EPSS probability is minimal (0.05%, 15th percentile), no active exploitation confirmed (not in CISA KEV), and no public exploit code identified at time of analysis, suggesting limited real-world exploitation activity despite the critical vulnerability class.
Remote code injection in the Kalium WordPress theme (versions ≤ 3.25) allows unauthenticated attackers to execute arbitrary PHP code on the server. The vulnerability has a CVSS 3.1 base score of 7.2 (High) with low confidentiality and integrity impact and no availability impact. No active exploitation has been reported to date, and the EPSS score (0.09%) indicates a low probability of widespread exploitation.
Privilege escalation in Dokan (WordPress multi-vendor marketplace plugin) versions up to 4.1.3 allows high-privileged users to elevate their permissions beyond intended role boundaries. Reported by Patchstack audit team with EPSS exploitation probability of 0.08% (24th percentile), indicating low real-world exploitation likelihood. No confirmed active exploitation (not in CISA KEV) or public proof-of-concept identified at time of analysis.
Missing authorization in the Billingo WordPress plugin (versions ≤4.3.0) enables authenticated high-privilege users to escalate privileges through unprotected API endpoints. CVSS 7.2 indicates network-accessible exploitation requiring high-privilege authentication with high impact across confidentiality, integrity, and availability. EPSS score of 0.06% (18th percentile) suggests low observed exploitation probability. No CISA KEV listing or public exploit identified at time of analysis, though Patchstack vulnerability database confirms the vulnerability class as both authentication bypass and privilege escalation.
Privilege escalation in the WooCommerce Wholesale Suite (woocommerce-wholesale-prices) plugin for WordPress through version 2.2.4.2 allows an already-authenticated user to gain privileges beyond what they were assigned. Rated CVSS 7.2 (high) with a network vector but requiring high privileges, the flaw stems from incorrect privilege assignment (CWE-266) and can lead to full compromise of the affected store's confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.05%, 16th percentile), indicating limited near-term mass-exploitation likelihood.
Reflected cross-site scripting (XSS) in the Contact Form by Supsystic WordPress plugin (versions through 1.7.36) allows unauthenticated remote attackers to execute malicious JavaScript in victims' browsers via crafted URLs. The vulnerability enables session hijacking, credential theft, and malicious actions performed in the context of the victim's authenticated session. EPSS probability indicates low exploitation likelihood (0.07%, 22nd percentile) with no public exploit identified at time of analysis.
Reflected Cross-Site Scripting (XSS) in WordPress plugin oik-privacy-policy versions ≤1.4.10 allows remote attackers to execute arbitrary JavaScript in victims' browsers. Exploitation requires user interaction (victim must click malicious link). EPSS probability is low (0.07%, 22nd percentile), and no active exploitation is confirmed. Reported by Patchstack security audit team, indicating professional vulnerability disclosure.
Reflected cross-site scripting (XSS) in Crocoblock JetSearch WordPress plugin versions through 3.5.10 allows unauthenticated remote attackers to execute arbitrary JavaScript in victim browsers via maliciously crafted URLs. The vulnerability requires user interaction (clicking a malicious link) but carries a changed scope, meaning successful exploitation can impact resources beyond the vulnerable component. EPSS probability is low (0.07%, 22nd percentile), indicating minimal observed exploitation attempts, and no public exploit code or CISA KEV listing exists at time of analysis.
Reflected cross-site scripting in the WordPress Likert Survey Master plugin allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL. Successful exploitation requires tricking an administrator into clicking the link while authenticated, potentially leading to session hijacking or malicious actions performed in the victim's browser context. No active exploitation or public exploit code has been identified, and the EPSS score indicates very low exploit likelihood (0.07%).
Reflected cross-site scripting in the MultiSite Clone Duplicator WordPress plugin through version 1.5.3 allows attackers to execute arbitrary JavaScript in victims' browsers when they click a crafted link. Successful exploitation could lead to session hijacking, data theft, or unauthorized actions on behalf of the user. No active exploitation or public exploits are known, and EPSS predicts very low exploitation likelihood (0.06%).
Stored cross-site scripting in the Toast Mobile Menu WordPress plugin (<=1.0.8) allows unauthenticated attackers to inject malicious scripts that execute when a user views an infected page, potentially leading to session hijacking or content manipulation. No active exploitation or public proof-of-concept is confirmed at time of analysis, and the EPSS score indicates a low probability of real-world attacks.
Reflected cross-site scripting in NextMove Lite (WordPress thank-you page plugin) versions ≤2.24.0 allows unauthenticated remote attackers to execute malicious JavaScript in victim browsers via crafted URLs. The vulnerability requires user interaction (clicking a malicious link) but achieves scope change per CVSS vector, enabling session hijacking, credential theft, or malicious actions under victim's WordPress session. EPSS score of 0.03% (8th percentile) indicates low probability of mass exploitation, though XSS vulnerabilities are commonly used in targeted social engineering campaigns against WordPress site administrators.
Reflected cross-site scripting in the CropRefine WordPress plugin (<= 1.2.1) allows unauthenticated attackers to inject arbitrary web scripts by tricking a user into clicking a crafted link. The vulnerability, reported by Patchstack, has a CVSS 7.1 high severity but a very low EPSS exploitation probability (0.03%), and no active exploitation or public exploit code has been identified.
Reflected cross-site scripting in bbPress Notify plugin versions up to 2.19.5 allows unauthenticated remote attackers to execute malicious JavaScript in victim browsers through crafted URLs. The vulnerability stems from improper input sanitization during web page generation (CWE-79). With CVSS 7.1 and changed scope (S:C), successful exploitation enables session hijacking, credential theft, and malicious actions in the victim's context. EPSS score of 0.03% (8th percentile) indicates low observed exploitation probability, and no active exploitation is confirmed (not in CISA KEV), though Patchstack has publicly documented the vulnerability.
Reflected cross-site scripting in Robokassa payment gateway for WooCommerce (versions ≤1.8.5) allows remote attackers to execute malicious JavaScript in victim browsers through specially crafted URLs. The scope-change CVSS flag indicates attackers can impact resources beyond the vulnerable plugin itself, potentially compromising WooCommerce admin sessions or customer payment data. EPSS probability is low (0.03%, 8th percentile), and no active exploitation or public POC has been identified at time of analysis.
We need to generate a JSON with fields: product_name, summary, technical_context, risk_assessment, affected_products, remediation, exploit_scenario, exploitation_conditions, attack_chain, confidence_notes, prevalence, prevalence_basis, assessed_cvss_vector, assessed_cvss_rationale, assessed_cvss40_vector. Given CVE: CVE-2025-59006. Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themebon Easy Woocommerce Customizer easy-woocommerce-customizer allows Reflected XSS. Affects from n/a through <= 1.0.2. CVSS: 7.1, vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS: 0.03% (percentile 8%). Tags: XSS, WordPress. Reference: patchstack. No KEV, no POC mentioned. CWE-79. Product: Easy Woocommerce Customizer plugin for WordPress. So product_name: "Easy Woocommerce Customizer". Summary: Reflected XSS in the plugin allows unauthenticated attackers to inject malicious scripts via user input reflected on a page, requiring user interaction (clicking a crafted link). Affected versions <=1.0.2. No active exploitation reported, no POC, EPSS low. So summary: "Reflected cross-site scripting in the Easy Woocommerce Customizer WordPress plugin (up to 1.0.2) allows unauthenticated remote attackers to execute arbitrary JavaScript in the browser of an authenticated administrator or other user who clicks a crafted link. Successful exploitation could lead to session hijacking, site defacement, or redirection to malicious sites, but requires user interaction." But need to avoid copying description, be original synthesis. So: "Reflected cross-site scripting vulnerability in the Easy Woocommerce Customizer WordPress plugin (<=1.0.2) enables unauthenticated attackers to inject arbitrary web scripts into pages that are reflected back to the victim. When an administrator or logged-in user clicks a crafted link, the attacker can execute JavaScript in their session, potentially leading to administrative takeover." No active exploitatio
We need to generate a comprehensive analysis for CVE-2025-58966 based on the provided information. The input is minimal, but we must synthesize using all available data: description, CVSS, EPSS, references, etc. Let's extract: - CVE ID: CVE-2025-58966 - Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms LITE nex-forms-lite allows Reflected XSS. This issue affects NEX-Forms LITE: from n/a through < 8.2. - CVSS: 7.1, vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L - CWE: CWE-79 - EPSS: 0.03% (8th percentile) – low exploitation probability. - Reported by: audit@patchstack.com - Tags: XSS - References: a PATCHSTACK link (not NVD directly, but NVD mentions it? Input says [nvd] (None) and then reference to Patchstack). So the only reference is the patchstack vulnerability database link. - No KEV, no POC mentioned, no CPE strings directly, but product is "Basix NEX-Forms LITE" (WordPress plugin). Affected versions: n/a through < 8.2 (meaning all versions before 8.2 are vulnerable, fix in version 8.2? "through < 8.2" means up to but not including 8.2. So version 8.2 is the fix.) We must infer affected product name: "NEX-Forms LITE". It's a WordPress plugin. So product_name should be "NEX-Forms LITE". Summary: Must write original synthesis. Do not copy description. Impact: Reflected XSS allowing an attacker to inject arbitrary web scripts that execute in the context of a victim's browser when they click a crafted link. Affected product: NEX-Forms LITE plugin for WordPress, versions below 8.2. No KEV, no public exploit mentioned, EPSS is low (0.03%). So summary: "Reflected cross-site scripting in the NEX-Forms LITE WordPress plugin before version 8.2 allows unauthenticated remote attackers to inject arbitrary scripts into web pages viewed by other users, potentially leading to session hijacking or defacement. Exploitation requires user interaction (clicking a malicious link), and at the time of analysis, no active exploitation or public proof-of-concept is confirmed." Technical context: use CWE-79 (XSS) root cause. The plugin likely fails to properly sanitize user input in some parameter that gets reflected back in the response. Reflected XSS typical. No CPE strings, but it's a WordPress plugin. I'll mention the underlying technology: WordPress plugins use PHP, and improper output escaping leads to XSS. I'll educate about CWE-79. Risk assessment: CVSS 7.1 (high), with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (network, low complexity, no privileges, user interaction required, scope changed, low impact on confidentiality, integrity, availability). EPSS 0.03% (very low), not in KEV, no known public exploit. So risk is moderated by low EPSS and no evidence of active exploitation. The vulnerability is high severity but low real-world risk unless exploited in targeted attacks because it requires user interaction. That's a common XSS issue. So I'll contrast high CVSS with low EPSS and lack of active exploitation. Also, SSVC: Exploitation: None/PoC, Automatable: Yes (low complexity), Technical Impact: Total (well, low, but XSS can be leveraged for session hijacking, so I'll say Partial). So priority is low. Affected products: NEX-Forms LITE plugin for WordPress versions before 8.2. The patchstack advisory likely confirms. No CPE given, so I'll just state that. Remediation: Update to version 8.2 or later. Patchstack advisory reference. If no patch, but we have a fix version, so patch available. I'll state: "Upgrade to NEX-Forms LITE version 8.2 or higher." Link to advisory. No workarounds mentioned. Exploit scenario: Attacker crafts a URL with a malicious script in a vulnerable parameter and tricks an authenticated user (like admin) into clicking it. The script executes in the user's browser context, allowing theft of cookies, session tokens, or performing actions on behalf of the user. Low complexity, network vector. Exploitation conditions: Must have a victim click a malicious link (user interaction required). The vulnerability is reflected XSS, so the input is part of the URL/request. Likely no special configuration; default installation of plugin below 8.2 is vulnerable. No authentication needed to send the link, but the victim needs to be authenticated to the WordPress site for session hijacking? Actually, XSS can affect any user, but to steal admin session, victim must be logged in. The CVSS says UI:R, no privilege needed for attacker. So condition: "User interaction (clicking a link) is required. No special configuration; the vulnerability exists in default installations of NEX-Forms LITE before version 8.2. No authentication is required by the attacker to deliver the payload." So that's fine. Attack chain: Need to incorporate kill chain phases. Suggests: Attacker crafts malicious URL → Sends to victim via phishing → Victim clicks link → Reflected XSS payload executes in browser → Attacker's script steals cookies or performs actions. So chain: "Craft phishing email with embedded malicious link → Target opens the link → Browser reflects XSS payload in plugin's output → Execute script in victim's session → Exfiltrate session cookie or perform unauthorized actions." Confidence notes: Vendor patch confirmed by Patchstack advisory (version 8.2 fixes). No public exploit or active exploitation. EPSS low. CVE assigned by Patchstack. So confidence: "Vendor patch version 8.2 confirmed by Patchstack advisory. No evidence of public exploit or active exploitation. CVSS vector provided by Patchstack; scope changed assessment consistent with XSS crossing browser security contexts." Prevalence: The plugin "NEX-Forms LITE" is a WordPress form plugin. I'm not sure of its exact install base. It's a "LITE" version, maybe a freemium model. Could be low to medium. I'd guess low because it's not a top plugin like Contact Form 7. So prevalence: "low", basis: "niche WordPress form plugin with limited install base." If uncertain, "unknown" but I'll attempt low. Assessed CVSS vector: I'll provide my own independent assessment. The original vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. That seems accurate. Reflected XSS from network, no privileges, user interaction required, scope changed (can execute in other user's browser context), low impacts. That's fine. So I'll output same but with my rationale. Assessed CVSS40 vector: Convert to CVSS 4.0 base metrics. 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. In 4.0: AV:N (Network), AC:L (Low), AT:N (no attack requirement), PR:N, UI:R (user interaction required), VC:L? (confidentiality impact on vulnerable component? Actually in XSS, the vulnerable component is the web application that reflects the input, but the impact is on the user's browser (subsequent system). In 4.0, VC/VI/VA are for the vulnerable system itself, SC/SI/SA for subsequent. Reflected XSS typically doesn't affect the server's confidentiality/integrity directly, but may affect the web application's integrity if the attacker can inject content that modifies the page served to other users. That's a subsequent system. In 3.1, scope changed means the vulnerable component (server) is different from the impacted component (browser), so C/I/A on the vulnerable component are none or low. But in 3.1 they assigned C:L/I:L/A:L to the vulnerable component because they might consider the ability to inject script into the page as low integrity impact on the server (the page is modified). In 4.0, VC = confidentiality impact on vulnerable system, VI = integrity impact on vulnerable system, VA = availability impact on vulnerable system. XSS injection on server could modify the response, so maybe VI:L (low integrity) on vulnerable system, but it's typically considered a subsequent system impact. The vulnerable system is the web application; the attacker can inject script that gets reflected, but that doesn't necessarily alter the application's data or functionality beyond that response, so VI:L may be appropriate. Then subsequent system (browser) has SC:L for cookie theft, SI:L for phishing actions, SA:L maybe for denial? Usually XSS has no availability impact, so SA:N. So CVSS 4.0 could be: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:R/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N. But the 3.1 had C:L/I:L/A:L and scope changed, which maps to vulnerable component impacts all low. In 4.0, vulnerable component is the system where the vulnerability resides, and the impacts on that system when the exploit occurs. Reflected XSS: the attacker's payload gets reflected in the server's HTTP response. That response includes the injected script, which is a modification of the intended content, so integrity impact on the vulnerable system is low (VI:L). The attacker doesn't gain confidential info from the server by reflecting, so VC:N. The server's availability is unaffected, VA:N. Then the subsequent system (user's browser) suffers confidentiality loss (SC:L) from cookie theft, integrity loss (SI:L) from unauthorized actions, and possibly availability (SA:N). So I'll use: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:R/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N. That's consistent with low integrity on vulnerable system, and low confidentiality and integrity on subsequent. I'll output that. Assessed CVSS rationale: "User interaction required, low complexity; scope change reflects impact on user browser rather than server." I need a concise rationale. Ok, now craft all fields as plain strings. product_name: "NEX-Forms LITE" (1-3 words) summary: "Reflected cross-site scripting in NEX-Forms LITE WordPress plugin before version 8.2 allows unauthenticated attackers to execute arbitrary scripts in the context of a victim's browser via a crafted link. The vulnerability enables session hijacking, credential theft, or site defacement when a user clicks a malicious URL. At the time of analysis, no public exploit or active exploitation has been reported, and EPSS indicates a low probability of widespread exploitation." technical_context: "The vulnerability stems from improper neutralization of user-supplied input in the NEX-Forms LITE plugin, classified as CWE-79 (Cross-site Scripting). This WordPress plugin, written in PHP, fails to sanitize or encode reflected input, allowing injected HTML/JavaScript to be interpreted by browsers. Reflected XSS means the payload is embedded in a request (e.g., URL parameter) and echoed directly in the server's response without proper output escaping, executing in the context of any user who follows a crafted link." risk_assessment: "CVSS 3.1 base score 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L indicates network-accessible, low-complexity attack requiring user interaction; impacts are low across confidentiality, integrity, and availability with scope change. However, EPSS score of 0.03% (8th percentile) suggests a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV, and no public exploit code has been identified. Although a high CVSS rating is appropriate for a reflected XSS that can compromise user sessions, the realistic risk is tempered by the need for user interaction and the lack of active exploitation, placing this in the 'attend' rather than 'act' tier for most organizations." affected_products: "NEX-Forms LITE plugin for WordPress, all versions prior to 8.2. The fix is included in version 8.2. The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/nex-forms-lite/vulnerability/wordpress-nex-forms-lite-plugin-8-2-cross-site-scripting-xss-vulnerability?_s_id=cve) confirms the version range." remediation: "Upgrade the NEX-Forms LITE plugin to version 8.2 or later, as the vendor has resolved the reflected XSS vulnerability in this release. If immediate patching is not feasible, consider restricting access to the plugin’s public-facing
Reflected cross-site scripting in WP Tactical Popup plugin for WordPress (≤1.1) allows unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser via a crafted URL. Exploitation requires user interaction (clicking a malicious link), potentially leading to session hijacking or content manipulation. No active exploitation or public exploit has been identified at this time.