What is the CVSS score of CVE-2025-25089?

CVE-2025-25089 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Image Rotator are affected by CVE-2025-25089?

CVE-2025-25089 is a reflected XSS vulnerability in the Image Rotator WordPress plugin (all versions through 2.0) that could allow attackers to steal session credentials or perform unauthorized…

How to fix or mitigate CVE-2025-25089?

Within 24 hours: Inventory all WordPress installations and identify those running Image Rotator plugin version 2.0 or earlier; disable the plugin if not actively required. Within 7 days: Contact the plugin vendor for patch timeline or evaluate alternative image rotation solutions; if the plugin is critical, implement Web Application Firewall rules to block suspected XSS payloads in URL parameters targeting the plugin. Within 30 days: Upgrade to a patched version upon vendor release, or migrate to an alternative maintained plugin with security updates.

Image Rotator CVE-2025-25089

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-03-03 audit@patchstack.com

XSS

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Updated

Apr 25, 2026 - 01:32 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 18:29 vuln.today

CVE Published

Mar 03, 2025 - 14:15 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in appten Image Rotator allows Reflected XSS. This issue affects Image Rotator: from n/a through 2.0.

AnalysisAI

Reflected cross-site scripting in Image Rotator WordPress plugin allows remote attackers to inject malicious JavaScript via crafted URLs that execute in victim browsers when users click attacker-controlled links. Affects all versions through 2.0 with no public exploit identified at time of analysis. EPSS score of 0.15% (36th percentile) indicates low predicted exploitation probability, consistent with typical WordPress plugin XSS requiring user interaction.

Technical ContextAI

This is a reflected XSS vulnerability (CWE-79) in the Image Rotator WordPress plugin developed by appten. Reflected XSS occurs when user-supplied input is immediately returned in HTTP responses without proper sanitization or encoding, allowing attackers to inject malicious scripts. The vulnerability exists in the plugin's web page generation process where input parameters are incorporated into HTML output without neutralization. WordPress plugins frequently handle query parameters, form inputs, or URL fragments that, if improperly validated, can be exploited to inject JavaScript. The CVSS vector AV:N indicates the attack is deliverable over network protocols, while S:C (Changed scope) indicates the vulnerable component (WordPress plugin) is distinct from the impacted component (user's browser and WordPress session).

Affected ProductsAI

Image Rotator WordPress plugin by appten, all versions from earliest release through version 2.0. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/appten-image-rotator/vulnerability/wordpress-easy-wp-tiles-plugin-1-cross-site-scripting-xss-vulnerability-2 provides vulnerability details. No CPE data available to confirm exact version ranges or platform dependencies beyond WordPress CMS.

RemediationAI

Primary mitigation: Check the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/appten-image-rotator/vulnerability/wordpress-easy-wp-tiles-plugin-1-cross-site-scripting-xss-vulnerability-2 for vendor patch information. If no patched version is available, implement compensating controls: disable or uninstall the Image Rotator plugin if not mission-critical, as WordPress offers numerous alternative image rotation plugins. If the plugin must remain active, configure WordPress security headers including Content-Security-Policy to restrict inline script execution (trade-off: may break legitimate plugin functionality requiring inline scripts). Deploy Web Application Firewall rules to detect and block common XSS payloads in query parameters (trade-off: potential false positives requiring tuning). Educate WordPress administrators to avoid clicking untrusted links while authenticated (behavioral control, least reliable). Monitor WordPress access logs for suspicious query parameters containing script tags or JavaScript events.