What is the CVSS score of CVE-2025-3774?

CVE-2025-3774 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of PHP are affected by CVE-2025-3774?

An unauthenticated attacker can inject malicious scripts into your WordPress site running the Wise Chat plugin (versions up to 3.3.4), which will execute in visitors' browsers and potentially…

How to fix or mitigate CVE-2025-3774?

Within 24 hours: Audit all WordPress installations to identify Wise Chat plugin usage and version; disable the plugin immediately on affected sites until mitigation is implemented. Within 7 days: Implement WAF rules to block suspicious X-Forwarded-For headers and review chat logs for signs of exploitation. Within 30 days: Migrate to an alternative chat solution or wait for vendor patch availability; conduct a security assessment of all affected sites for injected malicious content.

PHP CVE-2025-3774

EUVD-2025-18449 HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-06-17 security@wordfence.com

WordPress XSS PHP

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18449

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 02:15 nvd

HIGH 7.2

DescriptionCVE.org

The Wise Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the X-Forwarded-For header in all versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

The Wise Chat WordPress plugin versions up to 3.3.4 contains a Stored Cross-Site Scripting (XSS) vulnerability in the X-Forwarded-For header processing that allows unauthenticated attackers to inject malicious scripts without authentication or user interaction. When vulnerable pages are accessed by site visitors, the injected scripts execute in their browsers, potentially enabling credential theft, session hijacking, or malware distribution. This vulnerability has a CVSS score of 7.2 (High) and affects all publicly-facing WordPress installations running the affected plugin versions.

Technical ContextAI

The Wise Chat plugin for WordPress (CPE: wp:wise-chat) fails to properly sanitize the X-Forwarded-For HTTP header, a standard header used by load balancers and proxies to indicate the client's originating IP address. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting), where user-controlled input from the X-Forwarded-For header is stored in the database and later rendered in HTML output without adequate escaping. The plugin processes this header—intended for IP logging or geolocation functionality—but fails to apply WordPress's standard escaping functions (such as esc_html(), wp_kses_post(), or sanitize_text_field()) during both input sanitization and output rendering. This allows attackers to inject arbitrary JavaScript that persists in the database and executes in the context of the affected WordPress site.

RemediationAI

IMMEDIATE ACTION REQUIRED: (1) Update the Wise Chat plugin to version 3.3.5 or later, which should contain fixes for X-Forwarded-For header sanitization and output escaping. Check the Wise Chat WordPress.org plugin page or vendor advisory for patched version availability. (2) If an immediate patch is unavailable, disable the Wise Chat plugin until a fix is released using wp-cli or the WordPress admin dashboard. (3) TEMPORARY MITIGATION (if plugin must remain active): Implement Web Application Firewall (WAF) rules to block requests with suspicious JavaScript patterns in the X-Forwarded-For header; sanitize or reject X-Forwarded-For headers at the reverse proxy/load balancer level if the header is not required for legitimate functionality. (4) INCIDENT RESPONSE: If the site has been live with vulnerable versions, audit server logs and database for indicators of stored XSS injection (search plugin chat/message tables for script tags, event handlers, or base64 encoding). Review user activity logs for suspicious admin account access or password changes. Scan the site with WordPress security plugins (Wordfence, Sucuri) to detect and remove any injected malicious content.