What is the CVSS score of CVE-2025-12017?

CVE-2025-12017 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

VNPAY Payment Gateway CVE-2025-12017

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-10-24 security@wordfence.com

WordPress XSS Woocommerce

6.1

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Unauthenticated remote reflected XSS requiring a victim click (PR:N, UI:R); scope changes to the browser (S:C) with limited confidentiality/integrity impact and no availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (wordfence).

CVSS VectorVendor: wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Metadata Corrected

Oct 08, 2026 - 14:40 vuln.today

tag: Woocommerce added

Analysis Generated

Oct 08, 2026 - 14:31 vuln.today

CVE Published

Oct 24, 2025 - 09:15 cve.org

MEDIUM 6.1

DescriptionCVE.org

The VNPAY Payment gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

AnalysisAI

Reflected cross-site scripting in the VNPAY Payment Gateway plugin for WordPress (slug vnpay-for-woocommerce) versions up to and including 1.0.0 lets remote attackers inject arbitrary script through the 'message' parameter handled by the Thankyou shortcode. Exploitation is not autonomous: per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), no attacker authentication is required, but a victim must be socially engineered into clicking a crafted link before the non-persistent payload executes in their browser. No public exploit code was identified at time of analysis, there is no CISA KEV listing, and EPSS is low at 0.22% (11th percentile), so this reads as a genuine but low-priority issue rather than a critical one.

Technical ContextAI

The affected code is a WordPress/WooCommerce payment gateway plugin, and the cited source reference points to the plugin's shortcode implementation file (vnpay-for-woocommerce/trunk/src/shortcodes/Thankyou.php), which handles the post-payment 'Thankyou' flow and renders a 'message' parameter back to the user. The root-cause class is CWE-79, improper neutralization of input during web page generation, specifically the reflected variant: user-supplied input is echoed into the response without adequate sanitization and output escaping. In CVSS terms, PR:N confirms the attacker does not need an account on the target site, UI:R confirms a victim's click is required, and S:C indicates the injected script can affect resources beyond the vulnerable component (for example, the victim's authenticated session in the WordPress/WooCommerce site context). The impact sub-scores (C:L/I:L/A:N) reflect limited confidentiality and integrity effects and no direct availability impact. Because the payload is reflected rather than stored, it does not persist for other site visitors and only reaches users who are individually tricked into following a malicious URL.

Affected ProductsAI

The VNPAY Payment Gateway plugin for WordPress, distributed under the slug vnpay-for-woocommerce, is affected in all versions up to and including 1.0.0. Any WordPress site running that plugin, including WooCommerce stores using VNPAY as a payment method, is potentially exposed when the vulnerable Thankyou shortcode/checkout flow is reachable and the 'message' parameter is reflected. No CPE strings were provided in the input data, so the affected inventory should be derived from plugin slug and version rather than a platform CPE. Vendor/source and advisory references supplied are the plugin source file at https://plugins.svn.wordpress.org/vnpay-for-woocommerce/trunk/src/shortcodes/Thankyou.php and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/b901f593-3691-4ea1-8ab6-1ddd68fa2e36?source=cve.

RemediationAI

No vendor-released patch was identified at time of analysis, and no fixed version number is available to cite. Until the plugin is updated, the most reliable mitigation is to deactivate and, if not business-critical, remove the VNPAY Payment Gateway plugin; the trade-off is loss of the VNPAY payment option for WooCommerce checkout. If the plugin must remain active, apply virtual patching at a WAF or reverse proxy to inspect and block or encode requests containing script-like content in the 'message' parameter, particularly against the Thankyou shortcode and checkout endpoints, accepting that overly strict filtering may break legitimate status messages. Additionally restrict access to the affected Thankyou flow where feasible and enforce server-side output encoding for the 'message' parameter in the plugin template, though modifying plugin code is a temporary measure that can be overwritten by updates. Monitor the Wordfence advisory page (https://www.wordfence.com/threat-intel/vulnerabilities/id/b901f593-3691-4ea1-8ab6-1ddd68fa2e36?source=cve) for a patched release and upgrade promptly when one becomes available, and remind users to avoid clicking unsolicited links that could carry reflected payloads.