What is the CVSS score of CVE-2025-15643?

CVE-2025-15643 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Adsmonetizer are affected by CVE-2025-15643?

The Adsmonetizer WordPress plugin (adsensei-b30) through version 3.2.4 contains a reflected cross-site scripting vulnerability (CVE-2025-15643) that could allow attackers to inject malicious scripts…

How to fix or mitigate CVE-2025-15643?

Within 24 hours, inventory all WordPress instances to identify any running the Adsmonetizer plugin (adsensei-b30) up to version 3.2.4; if the plugin is not business-critical, disable or remove it immediately. Within 7 days, for sites where the plugin must remain active, deploy web application firewall (WAF) rules to filter reflected XSS payloads and enforce a strict Content Security Policy (CSP) to mitigate script injection; also restrict access to administrative interfaces and educate users about phishing links. Within 30 days, monitor the vendor's advisory channels for a patched version, and once released, schedule immediate upgrade; if no patch emerges, consider replacing the plugin with an alternative solution and conduct a security review of affected sites.

Adsmonetizer CVE-2025-15643

EUVD-2025-211027 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-10-05 Patchstack

GHSA-68ff-hqfv-r24v

WordPress XSS Wordpress Plugin Adsmonetizer

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-delivered reflected XSS needing victim click (UI:R, PR:N, AC:L); scope change (S:C) as script runs in browser context, with limited C/I/A per typical reflected XSS.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Oct 05, 2026 - 18:20 vuln.today

CVE Published

Oct 05, 2026 - 17:24 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jose Fernandez Adsmonetizer adsensei-b30 allows Reflected XSS.This issue affects Adsmonetizer: from n/a through 3.2.4.

Articles & Coverage 1

News 17 New WordPress Vulnerabilities - 2 Critical, 15 High Severity Oct 06, 2026

AnalysisAI

Reflected cross-site scripting (XSS) in the Adsmonetizer WordPress plugin (adsensei-b30) through version 3.2.4 allows remote attackers to inject arbitrary script into a victim's browser by convincing them to click a crafted link. The attacker does not need authentication, but exploitation requires user interaction and the targeted site must have the vulnerable plugin installed and reachable. This is rated CVSS 7.1, and no public exploit has been identified at time of analysis; it is not listed as confirmed actively exploited (CISA KEV).

Technical ContextAI

The vulnerability is a reflected cross-site scripting issue classified as CWE-79, meaning user-supplied input is not properly neutralized before being included in a web page generated by the Adsmonetizer plugin. The affected component is the WordPress plugin 'adsensei-b30' by Jose Fernandez, identified by CPE cpe:2.3:a:jose_fernandez:adsmonetizer:*:*:*:*:*:*:*:* covering all versions up to and including 3.2.4. Reflected XSS occurs when a request parameter is echoed back into the HTML response without adequate encoding or validation, allowing script execution in the context of the victim's browser session. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) indicates a network-reachable, low-complexity attack requiring no privileges but mandating user interaction; the scope change reflects that script executes in the victim's browser rather than the server.

RemediationAI

No vendor-released patch has been identified at time of analysis, so site administrators should treat Adsmonetizer versions up to 3.2.4 as vulnerable until a fixed release is published. Apply a web application firewall rule that blocks reflected XSS payloads in query strings and POST bodies, though this may cause false positives for legitimate content. Enforce a strict Content Security Policy that disallows inline script execution and untrusted script sources, recognizing that CSP may break legitimate plugin functionality if not carefully tuned. If the plugin is not essential, disable and remove it to eliminate the attack surface. Restrict access to the plugin's endpoints to trusted networks or authenticated users where feasible. Monitor the Patchstack advisory for updated version information and apply the vendor fix as soon as it becomes available.