What is the CVSS score of CVE-2025-25102?

CVE-2025-25102 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Yahoo BOSS are affected by CVE-2025-25102?

The Yahoo BOSS WordPress plugin versions up to 0.7 contain a reflected cross-site scripting vulnerability (CVE-2025-25102) that allows attackers to inject malicious JavaScript through crafted URLs,…

How to fix or mitigate CVE-2025-25102?

Within 24 hours: Inventory all WordPress installations and identify active deployments of Yahoo BOSS plugin versions up to 0.7; disable or remove the plugin immediately on all affected sites. Within 7 days: Contact Yahoo/plugin maintainer for patch status and timeline; evaluate alternative plugins if no patch emerges; implement Web Application Firewall (WAF) rules to block suspicious query parameters targeting the plugin. Within 30 days: Monitor Patchstack and WordPress plugin repository for security updates; once available, patch to the first version addressing CVE-2025-25102; conduct security awareness training for end-users on avoiding suspicious links.

Yahoo BOSS CVE-2025-25102

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-03-03 audit@patchstack.com

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Updated

Apr 25, 2026 - 01:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 18:29 vuln.today

CVE Published

Mar 03, 2025 - 14:15 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Yahoo BOSS allows Reflected XSS. This issue affects Yahoo BOSS: from n/a through 0.7.

AnalysisAI

Reflected cross-site scripting in the Yahoo BOSS WordPress plugin (versions up to 0.7) allows remote attackers to execute arbitrary JavaScript in victims' browsers through crafted URLs. The vulnerability requires user interaction (clicking a malicious link) but no authentication, enabling session hijacking, credential theft, and phishing attacks against WordPress site users. EPSS score of 0.09% (26th percentile) indicates low probability of mass exploitation, and no active exploitation is documented in CISA KEV. Patchstack database confirms the vulnerability with technical details available.

Technical ContextAI

This is a reflected XSS vulnerability (CWE-79) in the Yahoo BOSS WordPress plugin, which historically provided integration with Yahoo's BOSS (Build your Own Search Service) API. Reflected XSS occurs when user-supplied input is immediately echoed back in HTTP responses without proper sanitization or output encoding. The CVSS vector indicates network-based delivery (AV:N) with low attack complexity (AC:L), meaning exploitation requires only crafting a malicious URL with injected JavaScript payloads. The changed scope (S:C) indicates the vulnerability can affect resources beyond the vulnerable component itself, typical of XSS where attacker code executes in the victim's browser context with access to cookies, session tokens, and DOM manipulation capabilities across the WordPress site.

Affected ProductsAI

WordPress Yahoo BOSS plugin versions from initial release through 0.7 are confirmed vulnerable per Patchstack database analysis. The plugin provided search functionality integration with Yahoo's BOSS API service. No CPE identifiers are available in NVD data. Given Yahoo discontinued the BOSS API service in 2016, this plugin is effectively abandoned and likely installed on only legacy WordPress sites that have not updated their plugin inventory. Affected deployments are WordPress installations running any version of the Yahoo BOSS plugin up to and including version 0.7. Vendor advisory available at https://patchstack.com/database/wordpress/plugin/yahoo-boss/vulnerability/wordpress-yahoo-boss-plugin-0-7-reflected-cross-site-scripting-xss-vulnerability.

RemediationAI

Immediately remove the Yahoo BOSS plugin from all WordPress installations, as the underlying Yahoo BOSS API service was discontinued in 2016 and no patches are expected for this abandoned plugin. Navigate to WordPress admin dashboard, select Plugins, locate Yahoo BOSS, and click Deactivate then Delete. No functional replacement is necessary since the backend service no longer exists. For organizations unable to immediately remove the plugin, implement temporary compensating controls: deploy Web Application Firewall (WAF) rules to filter script tags and JavaScript event handlers in URL parameters (trade-off: may break legitimate query strings containing special characters), enable Content Security Policy headers with script-src 'self' directive to prevent inline script execution (trade-off: requires auditing existing WordPress theme and plugins for CSP compatibility), and restrict wp-admin access to trusted IP ranges via firewall rules (trade-off: breaks remote administration). These mitigations reduce but do not eliminate XSS risk. Priority action is complete plugin removal given its non-functional status.