What is the CVSS score of CVE-2025-30940?

CVE-2025-30940 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Melipayamak are affected by CVE-2025-30940?

CVE-2025-30940 presents moderate security risk, a cross-site scripting vulnerability rated CVSS 5.9. Attackers could inject scripts to steal sessions or perform actions as authenticated users.

How to fix or mitigate CVE-2025-30940?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Melipayamak CVE-2025-30940

EUVD-2025-17210 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-06-06 audit@patchstack.com

WordPress XSS Wordpress Plugin

5.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.9 MEDIUM

Requires high privileges and user interaction; scope changes due to XSS impact on other users.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17210

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 13:15 nvd

MEDIUM 5.9

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in melipayamak Melipayamak allows Stored XSS. This issue affects Melipayamak: from n/a through 2.2.12.

AnalysisAI

Stored cross-site scripting in the Melipayamak WordPress plugin version 2.2.12 and earlier allows high-privilege authenticated users to inject malicious scripts that execute in other users' browsers, potentially hijacking sessions or redirecting to malicious sites. Exploitation requires user interaction; no active exploitation or public proof-of-concept has been observed, and EPSS indicates very low exploitation probability.

Technical ContextAI

The vulnerability resides in the Melipayamak WordPress plugin, which handles SMS services. It stems from improper neutralization of user-supplied input before rendering in web pages (CWE-79), enabling stored cross-site scripting. Affected versions include all releases up to 2.2.12 as per the CPE-identified product 'melipayamak'. The flaw likely exists in an administrative settings or message template field where insufficient output sanitization allows script persistence.

RemediationAI

No official patched version has been released as of the advisory. Mitigations include restricting high-privilege user access to trusted individuals, disabling the plugin if not essential, or implementing a Web Application Firewall (WAF) rule to block XSS payloads targeting Melipayamak inputs. Monitor the plugin's changelog for future updates and apply the fix once available.