What is the CVSS score of CVE-2025-25133?

CVE-2025-25133 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of WP Frontend Submit are affected by CVE-2025-25133?

WP Frontend Submit versions 1.1.0 and earlier contain a stored cross-site scripting (XSS) vulnerability that could allow attackers to inject malicious code into web pages viewed by your users,…

How to fix or mitigate CVE-2025-25133?

Within 24 hours: audit all installations of WP Frontend Submit to identify affected versions (1.1.0 and earlier) and document exposure. Within 7 days: either upgrade to version 1.1.1 or later if available, or disable the WP Frontend Submit plugin entirely pending vendor patch confirmation. Within 30 days: implement Web Application Firewall (WAF) rules to filter malicious JavaScript payloads in user-submitted content and conduct security awareness training on phishing risks given the session-stealing potential.

WP Frontend Submit CVE-2025-25133

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-03-03 audit@patchstack.com

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Updated

Apr 25, 2026 - 01:17 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 18:29 vuln.today

CVE Published

Mar 03, 2025 - 14:15 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound WP Frontend Submit allows Cross-Site Scripting (XSS). This issue affects WP Frontend Submit: from n/a through 1.1.0.

AnalysisAI

Cross-site scripting (XSS) in WP Frontend Submit 1.1.0 and earlier allows remote attackers to execute arbitrary JavaScript in victim browsers via maliciously crafted input. The vulnerability features network-based attack vector with low complexity but requires user interaction, enabling attackers to modify page content and steal session tokens with changed security context (scope:changed). EPSS score of 0.09% (26th percentile) indicates very low automated exploitation probability, and no active exploitation or public POC has been identified at time of analysis.

Technical ContextAI

This vulnerability stems from improper neutralization of user input during web page generation (CWE-79), commonly known as stored or reflected XSS. WP Frontend Submit is a WordPress plugin that allows users to submit content via frontend forms. The plugin fails to adequately sanitize or encode user-supplied input before rendering it in web pages, enabling injection of malicious JavaScript. The scope:changed (S:C) metric in the CVSS vector indicates the vulnerability affects resources beyond the vulnerable component itself - typical of XSS where attacker-controlled code executes in the victim's browser context with access to cookies, session tokens, and DOM manipulation capabilities across the WordPress site's origin. The WordPress plugin ecosystem's reliance on developer-implemented input validation makes such vulnerabilities common when secure coding practices are not followed.

Affected ProductsAI

WP Frontend Submit WordPress plugin versions from the initial release through 1.1.0 are confirmed vulnerable based on NVD data. The CPE applicability range begins at an unspecified early version (n/a) and includes all releases up to and including version 1.1.0. Sites running this plugin in default or customized configurations with frontend submission forms enabled are affected. Patchstack vulnerability database entries at https://patchstack.com/database/wordpress/plugin/wp-frontend-submit/vulnerability/ provide additional technical details, though the referenced URL appears to contain path inconsistencies between 'wordpress/plugin' and 'Wordpress/Plugin' case variations.

RemediationAI

Upgrade WP Frontend Submit to version 1.1.1 or later if available, as version 1.1.0 is confirmed vulnerable and newer versions typically address reported security issues. Check the official WordPress plugin repository and vendor communications for the latest patched release. If immediate patching is not feasible, implement compensating controls: disable frontend submission functionality if not actively required for business operations (trade-off: breaks user-generated content workflows), restrict submission form access to authenticated trusted users only via WordPress role-based access controls (reduces but does not eliminate XSS risk as authenticated users can still be attackers), implement Content Security Policy headers with strict script-src directives to limit inline JavaScript execution (trade-off: may break legitimate plugin functionality requiring inline scripts - test thoroughly in staging), and enable Web Application Firewall rules targeting XSS patterns in POST parameters to submission endpoints. Consult Patchstack database entries at https://patchstack.com/database/wordpress/plugin/wp-frontend-submit/ for specific indicators of compromise and additional mitigation guidance, though verify URLs as reference links contain formatting inconsistencies.