What is the CVSS score of CVE-2025-28891?

CVE-2025-28891 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of price-calc WordPress Plugin are affected by CVE-2025-28891?

The price-calc WordPress plugin (versions ≤0.6.3) contains a stored XSS vulnerability exploitable via CSRF that can compromise administrator accounts when users are socially engineered to visit…

How to fix or mitigate CVE-2025-28891?

Within 24 hours: Disable or remove price-calc plugin versions ≤0.6.3 from all WordPress installations; audit admin access logs for suspicious activity. Within 7 days: Contact plugin vendor for patch timeline; evaluate alternative pricing plugins if no update is released. Within 30 days: Implement Web Application Firewall (WAF) rules blocking CSRF attacks to price-calc endpoints; enforce Content Security Policy (CSP) headers; conduct security awareness training on phishing and social engineering targeting administrators.

price-calc WordPress Plugin CVE-2025-28891

HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-03-11 audit@patchstack.com

WordPress XSS CSRF Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Updated

Apr 25, 2026 - 00:45 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 19:52 vuln.today

CVE Published

Mar 11, 2025 - 21:15 nvd

HIGH 7.1

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in jazzigor price-calc allows Stored XSS. This issue affects price-calc: from n/a through 0.6.3.

AnalysisAI

Stored XSS can be injected into price-calc WordPress plugin (versions up to 0.6.3) via CSRF attack vector, allowing attackers to execute malicious scripts in administrator browsers when authenticated users are tricked into visiting attacker-controlled pages. This chained vulnerability (CSRF enabling XSS) affects sites with authenticated administrative users and can lead to account compromise, privilege escalation, or malicious site modifications. EPSS score of 0.05% (14th percentile) indicates low probability of widespread exploitation, though the attack requires only user interaction (CVSS UI:R) rather than authentication from the attacker perspective.

Technical ContextAI

This vulnerability chains two distinct weaknesses: Cross-Site Request Forgery (CWE-352) as the initial vector that enables Stored XSS injection. The price-calc WordPress plugin fails to implement CSRF tokens (nonces) on administrative functions that accept user input, allowing attackers to craft malicious requests that administrators unknowingly execute. These forged requests inject persistent JavaScript payloads into the plugin's stored data (likely price calculation configurations or templates). When other users or administrators access pages rendering this stored data, the malicious scripts execute in their browser context. The CVSS scope change (S:C) indicates the vulnerability escapes the plugin's security boundary to affect WordPress core or other components, typical of XSS attacks that can access cookies, session tokens, and perform actions across the entire administrative interface.

Affected ProductsAI

WordPress price-calc plugin versions from earliest release through 0.6.3 are confirmed vulnerable per Patchstack advisory. The vulnerability affects all WordPress installations running these plugin versions regardless of WordPress core version or hosting environment. CPE data not provided in vulnerability disclosure. Complete affected version range and patch status available at Patchstack database entry: https://patchstack.com/database/wordpress/plugin/price-calc/vulnerability/wordpress-price-calc-plugin-0-6-3-csrf-to-stored-xss-vulnerability

RemediationAI

Upgrade price-calc plugin to version 0.6.4 or later if available, verifying from the official WordPress plugin repository or vendor advisory that CSRF protections and input sanitization have been implemented. Patchstack advisory at https://patchstack.com/database/wordpress/plugin/price-calc/vulnerability/wordpress-price-calc-plugin-0-6-3-csrf-to-stored-xss-vulnerability provides patch confirmation and mitigation guidance. If immediate upgrade is not feasible, implement compensating controls: restrict plugin administrative functions to specific trusted IP addresses via web application firewall rules (trade-off: legitimate remote administrators cannot access configuration); disable the price-calc plugin entirely until patched if pricing calculator functionality is non-critical (trade-off: loss of business functionality); implement Content Security Policy headers to restrict inline JavaScript execution, reducing XSS impact (trade-off: may break legitimate plugin features relying on inline scripts); educate WordPress administrators to avoid clicking external links while logged into admin panel (trade-off: relies on human behavior, not technical control).