What is the CVSS score of CVE-2025-26585?

CVE-2025-26585 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of DL Leadback are affected by CVE-2025-26585?

The DL Leadback WordPress plugin (versions up to 1.2.1) contains a reflected cross-site scripting vulnerability that could allow attackers to steal administrator session cookies or harvest…

How to fix or mitigate CVE-2025-26585?

Within 24 hours: Audit all WordPress installations for DL Leadback plugin presence and version; identify affected instances. Within 7 days: Disable or remove DL Leadback plugin from all WordPress sites running version 1.2.1 or earlier, or implement compensating controls (see below). Within 30 days: Monitor Patchstack and official plugin repositories for version 1.2.2 or later; deploy patched version immediately upon release, or identify and deploy alternative plugin with equivalent functionality.

DL Leadback CVE-2025-26585

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-03-03 audit@patchstack.com

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Updated

Apr 25, 2026 - 01:05 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 18:29 vuln.today

CVE Published

Mar 03, 2025 - 14:15 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound DL Leadback allows Reflected XSS. This issue affects DL Leadback: from n/a through 1.2.1.

AnalysisAI

Reflected cross-site scripting in DL Leadback WordPress plugin versions up to 1.2.1 allows remote attackers to inject malicious scripts that execute in victim browsers when users click crafted links. The vulnerability permits theft of session cookies, credential harvesting, or defacement of WordPress admin interfaces. EPSS score of 0.09% (26th percentile) suggests low observed exploitation activity, and no active exploitation is confirmed via CISA KEV. Patchstack documented this XSS flaw affecting all installations through version 1.2.1.

Technical ContextAI

DL Leadback is a WordPress plugin for tracking lead sources and referrer information. The CWE-79 (Cross-site Scripting) flaw stems from improper neutralization of user-supplied input before rendering it in HTML output - the plugin fails to sanitize or encode attacker-controlled data (likely URL parameters or form inputs) before reflecting them back in web pages. WordPress plugins commonly introduce XSS when handling $_GET or $_REQUEST variables without using WordPress escaping functions like esc_html(), esc_url(), or wp_kses(). The CVSS scope change (S:C) indicates the vulnerability can affect resources beyond the vulnerable component's security scope, typical when XSS executes in authenticated admin contexts with cross-domain implications.

Affected ProductsAI

DL Leadback WordPress plugin versions from initial release through 1.2.1 are confirmed vulnerable per Patchstack research. All WordPress sites with DL Leadback installed in versions ≤1.2.1 are affected regardless of WordPress core version. No CPE identifier was provided in NVD data. Vendor advisory available at https://patchstack.com/database/wordpress/plugin/dl-leadback/vulnerability/wordpress-dl-leadback-plugin-1-2-1-reflected-cross-site-scripting-xss-vulnerability.

RemediationAI

Upgrade DL Leadback plugin to version 1.2.2 or later if available, per standard WordPress plugin update procedures (Dashboard → Plugins → Update). Verify patch availability at the official WordPress plugin repository or contact plugin author NotFound directly. If patched version is not yet released, implement compensating controls: disable the DL Leadback plugin entirely via WordPress admin panel until patch is available; configure WordPress Web Application Firewall (WAF) rules to block common XSS payloads in query parameters (trade-off: may cause false positives for legitimate special characters in URLs); restrict WordPress admin access to trusted IP ranges via .htaccess or hosting provider firewall (reduces attack surface but limits remote administration). Review WordPress access logs for suspicious query parameters containing script tags, event handlers, or JavaScript protocol handlers to detect exploitation attempts. Patchstack advisory: https://patchstack.com/database/wordpress/plugin/dl-leadback/vulnerability/wordpress-dl-leadback-plugin-1-2-1-reflected-cross-site-scripting-xss-vulnerability.