What is the CVSS score of CVE-2025-25158?

CVE-2025-25158 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Uncomplicated SEO are affected by CVE-2025-25158?

The Uncomplicated SEO WordPress plugin version 1.2 and earlier contains a reflected cross-site scripting (XSS) vulnerability that could allow attackers to inject malicious scripts into administrator…

How to fix or mitigate CVE-2025-25158?

Within 24 hours: Audit all WordPress installations for Uncomplicated SEO plugin presence and version; document affected instances and administrators. Within 7 days: Disable or remove the vulnerable plugin from all production WordPress sites, or restrict admin access to plugin settings; contact the plugin vendor for patch timeline and interim guidance. Within 30 days: Monitor vendor advisory channels for a patched version; once released, test and deploy the updated plugin; review any administrative actions taken during exposure period for signs of compromise.

Uncomplicated SEO CVE-2025-25158

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-03-03 audit@patchstack.com

XSS

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Updated

Apr 25, 2026 - 01:14 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 18:29 vuln.today

CVE Published

Mar 03, 2025 - 14:15 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Uncomplicated SEO allows Reflected XSS. This issue affects Uncomplicated SEO: from n/a through 1.2.

AnalysisAI

Reflected cross-site scripting in the Uncomplicated SEO WordPress plugin through version 1.2 allows remote attackers to execute arbitrary JavaScript in victim browsers. The vulnerability requires user interaction (CVSS UI:R) and features a changed scope (S:C), indicating potential access to resources beyond the vulnerable component. With EPSS exploitation probability at 0.09% (26th percentile) and no CISA KEV listing, this represents a moderate real-world threat primarily relevant to targeted phishing campaigns against WordPress site administrators.

Technical ContextAI

The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation) within the Uncomplicated SEO WordPress plugin. This plugin likely handles SEO-related configuration or output generation without adequately sanitizing user-supplied input before reflecting it in HTML responses. Reflected XSS vulnerabilities occur when untrusted data from HTTP requests (typically URL parameters or form inputs) is immediately echoed into the web page without proper encoding or validation. The changed scope indicator (S:C) in the CVSS vector suggests the vulnerable component operates in a context where successful exploitation could affect resources managed under different security authorities, typical of WordPress plugins that interact with both the plugin's isolated functionality and broader WordPress administrative interfaces.

Affected ProductsAI

The vulnerability affects the Uncomplicated SEO WordPress plugin, specifically all versions from an unspecified starting point through version 1.2. The plugin identifier is 'uncomplicated-seo' in the WordPress plugin repository. According to Patchstack database references provided, this is a WordPress-specific plugin vulnerability. Organizations running WordPress installations with this plugin at version 1.2 or earlier should consider themselves affected. The exact initial vulnerable version is not specified in available data (listed as 'n/a'), suggesting all released versions up to and including 1.2 may be impacted.

RemediationAI

Upgrade the Uncomplicated SEO WordPress plugin to a version newer than 1.2 if available. Consult the Patchstack vulnerability database at https://patchstack.com/database/wordpress/plugin/uncomplicated-seo/vulnerability/wordpress-uncomplicated-seo-plugin-1-2-cross-site-scripting-xss-vulnerability for specific patch version information and vendor advisory. If no patched version is available or immediate upgrade is not feasible, implement compensating controls: disable or remove the Uncomplicated SEO plugin until a fix is released, restrict WordPress administrative access to trusted networks only via firewall rules or VPN requirements (mitigates remote attack vector), deploy web application firewall rules to detect and block XSS payloads in requests to plugin endpoints (may cause false positives requiring tuning), and educate administrative users about not clicking untrusted links while authenticated to WordPress (reduces user interaction likelihood but relies on human behavior). Each mitigation has trade-offs: plugin removal eliminates SEO functionality; network restrictions may hinder legitimate remote administration; WAF rules require ongoing maintenance and expertise.