What is the CVSS score of CVE-2025-22741?

CVE-2025-22741 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Felan Framework are affected by CVE-2025-22741?

The RiceTheme Felan Framework WordPress plugin (versions through 1.1.3) contains a reflected cross-site scripting vulnerability allowing unauthenticated attackers to compromise visitor browsers via…

How to fix or mitigate CVE-2025-22741?

24 hours: Audit all WordPress installations for Felan Framework plugin ≤v1.1.3 presence; document affected sites and user count. 7 days: Request patch timeline from RiceTheme vendor; deploy WAF rules to filter script injection in affected parameters; disable or remove the plugin if vendor provides no patch ETA. 30 days: Apply vendor patch to all instances upon release, or complete migration to alternative plugin if no patch forthcoming.

Felan Framework CVE-2025-22741

EUVD-2025-209955 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 audit@patchstack.com

GHSA-64x7-8qh7-xq7m

XSS

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:00 vuln.today

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RiceTheme Felan Framework allows Reflected XSS.

This issue affects Felan Framework: from n/a through 1.1.3.

AnalysisAI

Reflected cross-site scripting in the RiceTheme Felan Framework WordPress plugin (all versions through 1.1.3) lets a remote unauthenticated attacker inject script that executes in a victim's browser when the victim follows a crafted link. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) reflects a low-complexity, network-reachable flaw requiring user interaction with a changed scope, scored 7.1. There is no public exploit identified at time of analysis, and EPSS is very low at 0.03% (10th percentile), consistent with the CISA SSVC assessment of no observed exploitation.

Technical ContextAI

Felan Framework is a WordPress plugin published by RiceTheme; as a plugin it runs inside the PHP-based WordPress request lifecycle and renders output into HTML pages served to site visitors. The root cause is CWE-79, Improper Neutralization of Input During Web Page Generation, specifically the reflected variant: user-supplied input (typically a URL/request parameter) is echoed back into the generated HTML response without sufficient output encoding or sanitization, so attacker-controlled markup is interpreted as active script by the browser. Because this is reflected rather than stored, the malicious payload is delivered per-request via the link the victim clicks, not persisted in the WordPress database.

RemediationAI

No vendor-released patch version is identified in the available data; the reported affected range ends at 1.1.3 with no confirmed fixed release, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/felan-framework/vulnerability/wordpress-felan-framework-plugin-1-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve) and the RiceTheme/WordPress plugin page for an update beyond 1.1.3 and upgrade as soon as one is published. Until a fix is confirmed, deploy a Web Application Firewall (Patchstack or equivalent) with rules to block reflected XSS payloads in the plugin's request parameters, which adds latency and a small false-positive risk but requires no code change; alternatively, deactivate and remove the Felan Framework plugin if its functionality is non-essential, accepting loss of the features it provides. Reinforce defenses by setting a restrictive Content-Security-Policy header to constrain inline script execution, noting this can break legitimate inline scripts and themes and should be tested before enforcement.