What is the CVSS score of CVE-2025-25119?

CVE-2025-25119 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Woocommerce osCommerce Sync are affected by CVE-2025-25119?

The Woocommerce osCommerce Sync WordPress plugin (versions through 2.0.20) contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute malicious…

How to fix or mitigate CVE-2025-25119?

Within 24 hours: inventory all WordPress installations and identify deployments of Woocommerce osCommerce Sync plugin with version ≤2.0.20; notify administrators to restrict plugin access. Within 7 days: contact the plugin vendor for patch status and timeline; implement input validation rules at the WAF layer to block known attack patterns if available. Within 30 days: upgrade to patched version upon release, or disable/remove the plugin if no patch becomes available; conduct user awareness training on phishing risks targeting WordPress admin accounts.

Woocommerce osCommerce Sync CVE-2025-25119

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-03-03 audit@patchstack.com

WordPress XSS

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Updated

Apr 25, 2026 - 01:23 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 18:29 vuln.today

CVE Published

Mar 03, 2025 - 14:15 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Woocommerce osCommerce Sync allows Reflected XSS. This issue affects Woocommerce osCommerce Sync: from n/a through 2.0.20.

AnalysisAI

Reflected cross-site scripting in Woocommerce osCommerce Sync WordPress plugin versions through 2.0.20 enables remote attackers to execute arbitrary JavaScript in victim browsers via malicious URLs. The vulnerability requires user interaction (clicking a crafted link) but no authentication, making it exploitable through phishing or social engineering campaigns. With EPSS at 0.09% (26th percentile), exploitation probability remains low, and no active exploitation or public POC has been identified at time of analysis.

Technical ContextAI

This vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation) in the Woocommerce osCommerce Sync plugin, a WordPress extension enabling synchronization between WooCommerce stores and osCommerce platforms. The flaw occurs when user-supplied input - likely URL parameters or form data submitted to plugin endpoints - is reflected into generated HTML responses without proper sanitization or output encoding. WordPress plugins handling e-commerce synchronization tasks often process merchant-facing administrative interfaces with complex parameter handling, creating multiple injection points. The CVSS vector (AV:N/AC:L) confirms the vulnerability is remotely exploitable with low attack complexity, meaning straightforward URL manipulation without cryptographic or race-condition prerequisites.

Affected ProductsAI

The vulnerability affects NotFound's Woocommerce osCommerce Sync plugin for WordPress, versions from earliest release through 2.0.20 inclusive. This plugin facilitates product catalog and order synchronization between WooCommerce (WordPress e-commerce platform) and osCommerce (standalone e-commerce solution). All installations running version 2.0.20 or earlier are vulnerable. Patchstack database entry confirms affected version range at https://patchstack.com/database/wordpress/plugin/woo-oscommerce-sync/vulnerability/wordpress-easy-wp-tiles-plugin-1-cross-site-scripting-xss-vulnerability-4?_s_id=cve, though the URL string anomalously references 'easy-wp-tiles' which may indicate database tagging inconsistency rather than multi-plugin impact.

RemediationAI

Primary remediation: Upgrade Woocommerce osCommerce Sync to version 2.0.21 or later if available, though the input data does not independently confirm a released patch version beyond identifying the vulnerable range as 'through 2.0.20'. Check the WordPress plugin repository or vendor site for updates newer than 2.0.20. If no patched version exists or immediate upgrade is not feasible, implement compensating controls: (1) Restrict plugin administrative access to trusted IP addresses via WordPress security plugins or web application firewall rules, reducing phishing attack surface; (2) Deploy Content Security Policy headers with 'unsafe-inline' restrictions to limit injected JavaScript execution scope, though this may break legitimate plugin functionality requiring testing; (3) Educate administrators to avoid clicking untrusted links while authenticated to WordPress admin panel, particularly links in unsolicited emails referencing e-commerce operations; (4) Consider temporarily disabling the plugin if osCommerce synchronization is not business-critical until patch confirmation. Consult Patchstack advisory at https://patchstack.com/database/wordpress/plugin/woo-oscommerce-sync/vulnerability/wordpress-easy-wp-tiles-plugin-1-cross-site-scripting-xss-vulnerability-4?_s_id=cve for vendor-confirmed remediation steps. Side effects: Disabling synchronization breaks automated inventory updates between WooCommerce and osCommerce, requiring manual product management.