What is the CVSS score of CVE-2025-39539?

CVE-2025-39539 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by CVE-2025-39539?

A reflected cross-site scripting (XSS) vulnerability in Soho Hotel versions up to 4.2.5 allows attackers to inject malicious scripts that execute in users' browsers, potentially compromising guest…

How to fix or mitigate CVE-2025-39539?

Within 24 hours: inventory all Soho Hotel instances and isolate affected systems from public internet access if possible; notify users of the vulnerability and advise against clicking untrusted links. Within 7 days: deploy Web Application Firewall (WAF) rules to block XSS payloads; implement input validation and output encoding on all user-controllable parameters; conduct security awareness training for staff. Within 30 days: evaluate alternative hotel management solutions with active security support; contact vendor for patch timeline; perform comprehensive security audit of affected systems.

Wordpress Plugin CVE-2025-39539

EUVD-2025-17514 HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-06-09 audit@patchstack.com

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17514

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in quitenicestuff Soho Hotel allows Reflected XSS. This issue affects Soho Hotel: from n/a through 4.2.5.

AnalysisAI

Reflected Cross-Site Scripting (XSS) vulnerability in quitenicestuff Soho Hotel versions through 4.2.5 that allows unauthenticated attackers to inject malicious scripts into web pages viewed by other users. With a CVSS score of 7.1 and network accessibility requiring only user interaction, this vulnerability enables attackers to steal session cookies, perform actions on behalf of victims, or redirect users to malicious sites. The vulnerability affects the hotel management software's input validation during web page generation, creating a reflected XSS attack vector that exploits insufficient output encoding.

Technical ContextAI

This vulnerability stems from improper neutralization of user-supplied input during dynamic HTML generation, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The Soho Hotel application fails to properly sanitize or encode user-controllable parameters before reflecting them in HTTP responses. Reflected XSS vulnerabilities occur when untrusted data from HTTP requests is directly embedded into response pages without encoding, allowing attackers to craft malicious URLs containing JavaScript payloads. The application likely lacks context-aware output encoding (HTML entity encoding, JavaScript escaping, or URL encoding depending on context) at the point where user input is rendered to the page. This is a classic web application vulnerability affecting hotel management/booking systems where parameters like search terms, reservation details, or administrative inputs may be reflected in error messages, confirmations, or search results without proper sanitization.

RemediationAI

Immediate action: (1) Upgrade quitenicestuff Soho Hotel to version 4.2.6 or later (patch release addressing XSS input validation). (2) If immediate patching is not possible, implement Web Application Firewall (WAF) rules to detect and block common XSS payloads in URL parameters and POST data. (3) Deploy Content Security Policy (CSP) headers to prevent inline script execution and restrict script sources to trusted origins only. (4) Conduct a security audit of all user input points in the application (search fields, filter parameters, admin forms) to identify similar reflection vulnerabilities. (5) Implement output encoding at all points where user input is reflected—use parameterized templating or libraries that auto-encode by default (e.g., Django templates, Jinja2, or similar). (6) Enable HTTPOnly and Secure flags on session cookies to limit XSS impact. Contact quitenicestuff for official patch releases and vendor security advisories detailing the scope of the fix.