What is the CVSS score of CVE-2025-26563?

CVE-2025-26563 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Rocket Mobile are affected by CVE-2025-26563?

Rocket Mobile WordPress plugin versions through 1.3.3 contain a reflected XSS vulnerability that could allow attackers to hijack user sessions or steal credentials if users click malicious links.

How to fix or mitigate CVE-2025-26563?

Within 24 hours: Identify all WordPress instances running Rocket Mobile plugin and document affected versions via plugin management interface or vulnerability scanning. Within 7 days: Contact Rocket Mobile plugin vendor for patch timeline; if no patch is released, disable or remove the plugin from production environments. Within 30 days: Implement Web Application Firewall (WAF) rules to detect XSS payloads in URL parameters for this plugin, and conduct user awareness training on phishing links.

Rocket Mobile CVE-2025-26563

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-03-03 audit@patchstack.com

XSS

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Updated

Apr 25, 2026 - 01:06 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 18:29 vuln.today

CVE Published

Mar 03, 2025 - 14:15 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Mobile allows Reflected XSS. This issue affects Mobile: from n/a through 1.3.3.

AnalysisAI

Reflected cross-site scripting (XSS) in the Rocket Mobile WordPress plugin through version 1.3.3 allows remote attackers to inject malicious scripts via crafted URLs. Successful exploitation requires victim interaction (clicking a malicious link). The vulnerability enables scope change (S:C), allowing attackers to execute JavaScript in the context of another user's session, potentially leading to session hijacking, credential theft, or site defacement. EPSS score of 0.09% (26th percentile) suggests low observed exploitation in the wild, and no public exploit code or CISA KEV listing identified at time of analysis.

Technical ContextAI

This is a reflected XSS vulnerability (CWE-79) in the Rocket Mobile WordPress plugin, formerly known as 'rocket-wp-mobile' based on CPE and reference URLs. Reflected XSS occurs when user-supplied input is immediately rendered in the HTTP response without proper sanitization or output encoding. The plugin fails to neutralize special characters in input parameters during web page generation, allowing attackers to inject arbitrary HTML/JavaScript. The CVSS vector indicates changed scope (S:C), meaning the vulnerable component (WordPress plugin) can impact resources beyond its security scope, characteristic of XSS where attacker scripts execute in the victim's browser context. The vulnerability was reported by Patchstack's security audit team, indicating discovery through third-party security research rather than vendor disclosure.

Affected ProductsAI

The vulnerability affects Rocket Mobile WordPress plugin versions through 1.3.3, previously distributed under the slug 'rocket-wp-mobile'. Specific affected version range includes all versions from the plugin's initial release up to and including version 1.3.3. Patchstack vulnerability database references confirm this affects the WordPress plugin available through the official WordPress.org repository. Organizations running any version at or below 1.3.3 should consider themselves vulnerable and verify their installed version via WordPress admin dashboard under Plugins section.

RemediationAI

Upgrade Rocket Mobile plugin to version 1.3.4 or later if available, as versions through 1.3.3 are confirmed vulnerable. Check the WordPress admin dashboard (Plugins → Installed Plugins) for available updates or visit the official WordPress.org plugin repository. Full vendor advisory and patch details available at https://patchstack.com/database/wordpress/plugin/rocket-wp-mobile. If immediate patching is not feasible, implement compensating controls: deploy a Web Application Firewall (WAF) with XSS detection rules to filter malicious parameters (note: may cause false positives requiring rule tuning), restrict plugin usage to authenticated admin users only if functional requirements allow (reduces attack surface but limits mobile functionality), and implement Content Security Policy (CSP) headers with strict script-src directives to prevent inline script execution (may break legitimate plugin JavaScript requiring CSP nonce implementation). Monitor web server logs for suspicious query parameters containing script tags or JavaScript event handlers as interim detection measure.