What is the CVSS score of CVE-2025-39487?

CVE-2025-39487 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Rankie are affected by CVE-2025-39487?

CVE-2025-39487 presents moderate security risk, a cross-site scripting vulnerability rated CVSS 7.1.

How to fix or mitigate CVE-2025-39487?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Verify anti-CSRF tokens and content security policies are enforced.

Rankie CVE-2025-39487

EUVD-2025-19978 HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-07-04 audit@patchstack.com

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Reflected XSS has no direct availability impact, so A:N; scope changed due to execution in victim's browser context.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 02:42 euvd

EUVD-2025-19978

Analysis Generated

Mar 16, 2026 - 02:42 vuln.today

CVE Published

Jul 04, 2025 - 12:15 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ValvePress Rankie allows Reflected XSS. This issue affects Rankie: from n/a through 1.8.2.

AnalysisAI

Reflected cross-site scripting in the Rankie WordPress plugin up to version 1.8.2 allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL. An attacker can trick a logged-in user into clicking the link, potentially leading to session cookie theft or credential phishing. No active exploitation is confirmed and no public exploit code has been identified.

Technical ContextAI

Rankie is a WordPress plugin by ValvePress, likely used for ranking or SEO purposes. The vulnerability stems from improper input neutralization during web page generation (CWE-79) where user-supplied data is reflected in the response without adequate sanitization. The CVSS vector confirms the attack is network-based, requires no privileges, but does require user interaction (clicking a link). The vulnerable plugin versions are identified by CPE strings matching 'valvepress-rankie' up to and including 1.8.2, as listed in the EUVD advisory.

RemediationAI

Update the Rankie plugin to a version beyond 1.8.2 or the latest available release. If no patch version is explicitly listed, temporarily deactivate the plugin until a fix is released. As a compensating control, restrict access to the vulnerable admin panel to trusted IPs and implement a web application firewall (WAF) rule to filter reflected XSS attempts. Note that these workarounds may break functionality or require maintenance.