What is the CVSS score of CVE-2025-31426?

CVE-2025-31426 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by CVE-2025-31426?

A reflected cross-site scripting (XSS) vulnerability in LambertGroup Sticky Radio Player versions 3.4 and earlier allows attackers to inject malicious code that executes in users' browsers,…

How to fix or mitigate CVE-2025-31426?

Within 24 hours: Inventory all instances of Sticky Radio Player across web properties and disable the plugin if non-critical to operations. Within 7 days: Implement WAF rules to block XSS payloads targeting the vulnerable input vectors; review access logs for evidence of exploitation. Within 30 days: Monitor LambertGroup for patch availability and upgrade immediately upon release; consider replacing the plugin with a maintained alternative if no patch timeline is provided.

Wordpress Plugin CVE-2025-31426

EUVD-2025-17501 HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-06-09 audit@patchstack.com

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17501

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Sticky Radio Player allows Reflected XSS. This issue affects Sticky Radio Player: from n/a through 3.4.

AnalysisAI

Reflected Cross-Site Scripting (XSS) vulnerability in LambertGroup's Sticky Radio Player that allows unauthenticated attackers to inject malicious scripts into web pages through improper input sanitization. Versions 3.4 and earlier are affected, enabling attackers to execute arbitrary JavaScript in victims' browsers with user interaction. While the CVSS score of 7.1 indicates medium-to-high severity with potential for session hijacking and credential theft, real-world exploitability depends on KEV status, proof-of-concept availability, and deployment prevalence of this niche WordPress plugin.

Technical ContextAI

This vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic reflected XSS flaw where user-supplied input is echoed back to the browser without adequate HTML entity encoding or output validation. The Sticky Radio Player, a WordPress audio player plugin by LambertGroup, fails to sanitize URL parameters or form inputs before rendering them in HTTP responses. Attackers exploit this by crafting malicious URLs containing JavaScript payloads (e.g., '?search=<script>alert(1)</script>') that execute when victims click the link. The vulnerability is reflected (non-persistent), meaning the malicious payload must be delivered per-request, but requires no authentication (PR:N) and has low attack complexity (AC:L), making it trivial to exploit via phishing or compromised referrers.

RemediationAI

Primary: Upgrade Sticky Radio Player to version 3.5 or later (if available). Check the LambertGroup plugin repository on WordPress.org or the vendor's official website for patch availability. Verification: Verify that the WordPress plugin 'Sticky Radio Player' has been updated to a patched version. Go to WordPress Admin Dashboard > Plugins > Installed Plugins and confirm version number >3.4. Workaround: If an immediate patch is unavailable, apply input validation/output encoding at the web server level using a WAF (Web Application Firewall) rule to block requests containing script tags or encoded XSS payloads in query parameters. Defense-in-Depth: Implement Content Security Policy (CSP) headers (e.g., 'default-src 'self'; script-src 'self'') to restrict script execution and mitigate XSS impact. Monitoring: Monitor for exploitation attempts using WAF/IDS rules targeting XSS patterns in HTTP requests to pages that serve the Sticky Radio Player.