What is the CVSS score of CVE-2025-31925?

CVE-2025-31925 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by CVE-2025-31925?

A cross-site scripting (XSS) vulnerability in LambertGroup SHOUT versions up to 3.5.3 allows attackers to inject malicious code that executes in users' browsers, potentially compromising user…

How to fix or mitigate CVE-2025-31925?

Within 24 hours: Identify all instances of SHOUT in production and document version numbers; assess user-facing deployments for exposure priority. Within 7 days: Implement WAF rules to sanitize reflected input parameters; enable input validation and output encoding; restrict SHOUT access to authorized networks only if feasible. Within 30 days: Contact LambertGroup for patch timeline; evaluate upgrade path to a patched version; conduct security awareness training on phishing/social engineering that could exploit XSS.

Wordpress Plugin CVE-2025-31925

EUVD-2025-17507 HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-06-09 audit@patchstack.com

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17507

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup SHOUT allows Reflected XSS. This issue affects SHOUT: from n/a through 3.5.3.

AnalysisAI

Reflected Cross-Site Scripting (XSS) vulnerability in LambertGroup SHOUT versions up to 3.5.3 that allows unauthenticated attackers to inject malicious scripts into web pages viewed by victims. An attacker can craft a malicious URL containing JavaScript payloads that execute in the context of the victim's browser session, potentially stealing session tokens, credentials, or performing actions on behalf of the user. The vulnerability has a CVSS score of 7.1 (High), requires user interaction (clicking a malicious link), and affects network-accessible instances of SHOUT without authentication requirements.

Technical ContextAI

This vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), a fundamental input validation flaw where user-supplied data is reflected back into HTML responses without proper encoding or sanitization. The SHOUT application fails to neutralize untrusted input before rendering it in web page responses, allowing attackers to break out of expected data contexts and inject arbitrary HTML/JavaScript. This is a classic Reflected XSS vulnerability affecting server-side web applications; the attack vector is Network (AV:N) with Low Complexity (AC:L), indicating the vulnerability is trivial to exploit once a victim visits a crafted URL. The CPE identifier would be vendor:LambertGroup, product:SHOUT, versions:3.5.3 and earlier. The reflected nature (versus stored XSS) means the malicious payload must be delivered via URL or form submission in real-time.

RemediationAI

Upgrade SHOUT to version 3.5.4 or later (version containing the fix is not explicitly stated in description; contact LambertGroup for confirmation of patched version); priority: Critical Workaround (Temporary): Implement Web Application Firewall (WAF) rules to detect and block common XSS payloads (javascript:, onerror=, onload=, etc.) in URL parameters and form inputs; priority: High Workaround (Temporary): Restrict network access to SHOUT instances using firewall rules or VPN, limiting exposure to trusted users only; priority: High Code-Level Mitigation: Apply input encoding/sanitization: use context-aware output encoding (HTML entity encoding for HTML context, JavaScript encoding for script context), implement Content Security Policy (CSP) headers to restrict inline script execution; priority: Critical Detection: Monitor application logs for suspicious URL parameters containing script tags, event handlers (onerror, onclick, onload), or JavaScript protocol handlers; priority: Medium