What is the CVSS score of CVE-2025-26590?

CVE-2025-26590 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of Wordpress Plugin are affected by CVE-2025-26590?

A SQL injection vulnerability in the Complete Google SEO Scan plugin (versions up to 3.5.1) allows attackers to access or manipulate database contents, potentially exposing sensitive business data…

How to fix or mitigate CVE-2025-26590?

Within 24 hours: Audit all systems running Complete Google SEO Scan versions 3.5.1 or earlier and document business criticality; disable the plugin immediately if not actively used. Within 7 days: Implement Web Application Firewall (WAF) rules to block SQL injection patterns targeting the plugin, isolate affected systems to internal networks only, and establish database access monitoring for anomalous queries. Within 30 days: Evaluate replacement SEO scanning solutions, plan migration away from the vulnerable plugin, and conduct database audit for unauthorized access.

Wordpress Plugin CVE-2025-26590

EUVD-2025-17161 HIGH

SQL Injection (CWE-89)

2025-06-06 audit@patchstack.com

WordPress SQLi Google Wordpress Plugin

7.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17161

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 13:15 nvd

HIGH 7.6

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nir Complete Google Seo Scan allows SQL Injection. This issue affects Complete Google Seo Scan: from n/a through 3.5.1.

AnalysisAI

SQL Injection vulnerability in Nir Complete Google SEO Scan plugin (versions up to 3.5.1) that allows authenticated attackers with high privileges to execute arbitrary SQL commands against the database. While the CVSS score is 7.6 (high), the attack requires administrative credentials and does not enable data modification, limiting real-world impact to information disclosure and service degradation. No active exploitation in the wild has been confirmed at this time.

Technical ContextAI

The vulnerability exists in the Complete Google SEO Scan WordPress plugin, a tool designed to scan and analyze websites for Google SEO compliance. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), indicating that user-supplied input is inadequately sanitized before being incorporated into SQL queries. The affected component likely processes SEO scan parameters, filter criteria, or report generation functions without proper parameterized query implementation or input validation. The plugin operates within the WordPress ecosystem, meaning vulnerability exploitation would occur through the WordPress database abstraction layer (typically MySQL/MariaDB). The issue affects versions from an unspecified baseline through version 3.5.1.