What is the CVSS score of CVE-2025-31039?

CVE-2025-31039 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Wordpress Plugin are affected by CVE-2025-31039?

A critical XML External Entity (XXE) injection vulnerability in the pixelgrade Category Icon plugin (versions up to 1.0.2) allows attackers to read sensitive files and potentially execute arbitrary…

How to fix or mitigate CVE-2025-31039?

Within 24 hours: Inventory all instances of pixelgrade Category Icon across your environment and disable the plugin immediately if non-essential. Within 7 days: Implement WAF rules to block XXE payloads and deploy network segmentation to limit plugin access; evaluate alternative plugins for replacement. Within 30 days: Complete migration to a patched alternative plugin or wait for vendor patch release while maintaining compensating controls.

Wordpress Plugin CVE-2025-31039

EUVD-2025-17490 CRITICAL

Improper Restriction of XML External Entity Reference (CWE-611)

2025-06-09 audit@patchstack.com

WordPress XXE Wordpress Plugin

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17490

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

CRITICAL 9.1

DescriptionCVE.org

Improper Restriction of XML External Entity Reference vulnerability in pixelgrade Category Icon allows XML Entity Linking. This issue affects Category Icon: from n/a through 1.0.2.

AnalysisAI

CVE-2025-31039 is an XML External Entity (XXE) injection vulnerability in the Pixelgrade Category Icon WordPress plugin (versions through 1.0.2) that allows authenticated attackers with high privileges to read arbitrary files, execute remote code, or cause denial of service through improper XML entity validation. The vulnerability has a critical CVSS score of 9.1 but requires administrator-level privileges to exploit; active exploitation status and proof-of-concept availability are not confirmed from the provided intelligence.

Technical ContextAI

This vulnerability exploits CWE-611 (Improper Restriction of XML External Entity Reference), a class of attacks where XML parsers are configured to process external entity definitions without proper validation. The Category Icon plugin likely processes XML input (potentially from user-uploaded files, plugin configuration, or API responses) without disabling XXE protections in its XML parser. This could affect PHP's SimpleXML, DOMDocument, or similar parsing libraries. The 'XML Entity Linking' description suggests the vulnerability allows attackers to define custom entity references pointing to local files (file:// protocol) or remote resources, enabling information disclosure or server-side request forgery (SSRF). The affected product is CPE wp:plugin:pixelgrade-category-icon through version 1.0.2; remediation likely requires updating to a patched version (not specified in provided data) or disabling XXE processing via PHP configuration (libxml_disable_entity_loader, etc.).