What is the CVSS score of CVE-2025-25170?

CVE-2025-25170 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Migrate Posts are affected by CVE-2025-25170?

CVE-2025-25170 is a reflected cross-site scripting vulnerability in the Migrate Posts WordPress plugin (≤v1.0) that allows attackers to execute malicious JavaScript in user browsers through crafted…

How to fix or mitigate CVE-2025-25170?

Within 24 hours: audit installed WordPress plugins to identify all instances of Migrate Posts ≤v1.0 and document affected sites. Within 7 days: contact the plugin maintainers (Patchstack) directly to verify patch availability and timeline; if patching is unavailable, implement Web Application Firewall (WAF) rules to block requests containing script payloads targeting the plugin's vulnerable parameters. Within 30 days: either update to a patched version immediately upon release, or disable/remove the Migrate Posts plugin if the maintainer does not publish a fix within 30 days.

Migrate Posts CVE-2025-25170

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-03-03 audit@patchstack.com

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Updated

Apr 25, 2026 - 01:09 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 18:29 vuln.today

CVE Published

Mar 03, 2025 - 14:15 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Migrate Posts allows Reflected XSS. This issue affects Migrate Posts: from n/a through 1.0.

AnalysisAI

Reflected cross-site scripting in the Migrate Posts WordPress plugin (versions ≤1.0) allows remote attackers to execute arbitrary JavaScript in victim browsers via crafted requests. Attack requires user interaction (CVSS UI:R) but no authentication (PR:N), enabling social engineering vectors such as malicious links in phishing emails. Exploitation probability is low (EPSS 0.09%, 26th percentile) with no public exploit identified at time of analysis. Patchstack vulnerability database confirms the flaw but patch status requires verification with plugin maintainers.

Technical ContextAI

This is a classic reflected XSS vulnerability (CWE-79) in a WordPress plugin designed for migrating post content between sites or categories. The flaw stems from improper neutralization of user-supplied input before rendering it in HTML output. When the plugin processes HTTP parameters (likely in admin pages or migration wizards), it fails to sanitize or encode special characters, allowing attackers to inject arbitrary JavaScript payloads. WordPress plugins commonly handle GET/POST parameters for search, filtering, or configuration - if these values are echoed back to the page without escaping HTML entities like <, >, ", and ', browsers interpret injected <script> tags as executable code. The scope change (S:C in CVSS vector) indicates the vulnerability can affect resources beyond the vulnerable component's security context, typical when session cookies lack HttpOnly flags or when plugin pages interact with parent WordPress admin contexts.

Affected ProductsAI

WordPress Migrate Posts plugin versions from initial release through version 1.0 are confirmed vulnerable based on NVD CPE data and Patchstack advisory. The plugin is available through the official WordPress.org plugin repository (slug: migrate-post). Organizations can verify installed versions via WordPress admin dashboard under Plugins or by checking the main plugin file header. Patchstack advisory URL at https://patchstack.com/database/wordpress/plugin/migrate-post/vulnerability/wordpress-migrate-posts-plugin-1-0-post-based-cross-site-scripting-xss-vulnerability provides technical details but does not specify an exact fixed version number at time of CVE publication.

RemediationAI

Check the WordPress.org plugin repository and NotFound developer site for Migrate Posts updates beyond version 1.0 that address CVE-2025-25170. If a patched version is available, upgrade immediately via WordPress admin dashboard under Plugins > Updates. If no vendor-released patch is identified at time of analysis, implement compensating controls: restrict Migrate Posts plugin access to trusted administrator accounts only by removing Contributor/Editor role capabilities using a role management plugin like User Role Editor; enable Content Security Policy headers to mitigate JavaScript execution via web server or WordPress security plugin (note: CSP may break legitimate plugin functionality if inline scripts are blocked); audit WordPress admin access logs for suspicious GET/POST parameters containing script tags or JavaScript event handlers; consider disabling the plugin entirely if migration tasks are complete, as unused plugins expand attack surface. Monitor Patchstack advisory and WordPress plugin changelog for official patch release. All compensating controls reduce but do not eliminate XSS risk - upgrade remains the definitive solution.