What is the CVSS score of CVE-2025-30988?

CVE-2025-30988 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by CVE-2025-30988?

A stored cross-site scripting (XSS) vulnerability in CreativeMedia Elite Video Player (versions through 10.0.5) allows attackers to inject malicious code that persists in the application and executes…

How to fix or mitigate CVE-2025-30988?

Within 24 hours: Identify all instances of Elite Video Player in use across the organization and document affected systems and users. Within 7 days: Implement input validation and output encoding controls at the application level; deploy WAF rules to detect and block XSS payloads in video metadata and player parameters; restrict video upload and editing permissions to trusted administrators only. Within 30 days: Monitor vendor communications for patch availability; evaluate alternative video players if no patch timeline is provided; conduct security awareness training for users on risks of untrusted video sources.

Wordpress Plugin CVE-2025-30988

EUVD-2025-18548 HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-06-17 audit@patchstack.com

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18548

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 15:15 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in _CreativeMedia_ Elite Video Player allows Stored XSS. This issue affects Elite Video Player: from n/a through 10.0.5.

AnalysisAI

Stored Cross-Site Scripting (XSS) vulnerability in CreativeMedia Elite Video Player versions up to 10.0.5 that allows unauthenticated attackers to inject and persist malicious scripts through the web page generation process. An attacker can craft a malicious input that gets stored in the application and executed in the browsers of other users who view the affected page, potentially leading to session hijacking, credential theft, or malware distribution. The vulnerability requires user interaction (UI:R) but has a network attack vector with no authentication required, making it a moderate-to-high priority threat depending on deployment context.

Technical ContextAI

This vulnerability stems from improper input sanitization and output encoding during dynamic HTML page generation, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The Elite Video Player likely constructs HTML content dynamically using user-supplied input (such as video titles, descriptions, metadata, or configuration parameters) without adequately neutralizing special characters or encoding them for the HTML context. This allows attackers to break out of intended data contexts and inject arbitrary JavaScript code. The 'Stored' nature indicates the malicious payload persists in backend storage (database, files, or cache), making it more dangerous than reflected XSS as it affects all subsequent viewers. The vulnerability affects CreativeMedia Elite Video Player CPE: cpe:2.3:a:creativemedia:elite_video_player:*:*:*:*:*:*:*:* with versions from an unspecified baseline through 10.0.5.

RemediationAI

Immediate actions: (1) Identify all instances of CreativeMedia Elite Video Player running version 10.0.5 or earlier in your environment; (2) Upgrade to a patched version beyond 10.0.5 as soon as available from CreativeMedia (contact vendor or check security advisories at creativemedia.com or vendor security portal); (3) If immediate patching is not possible, implement input validation and output encoding mitigations: sanitize all user-supplied input using a whitelist-based approach, encode all dynamic content for HTML context using appropriate encoding functions (e.g., HTML entity encoding), and apply Content Security Policy (CSP) headers to restrict inline script execution; (4) Implement Web Application Firewall (WAF) rules to detect and block common XSS payloads in requests; (5) Monitor application logs for suspicious input patterns or unusual script injection attempts; (6) Review stored data for any evidence of injected malicious scripts and remediate compromised records. Consult the vendor's security advisory for specific patch version numbers and timeline.