What is the CVSS score of CVE-2025-46500?

CVE-2025-46500 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-46500

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-07-16 audit@patchstack.com

WordPress XSS

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:42 NVD

7.1 (HIGH)

Analysis Generated

Apr 01, 2026 - 17:43 vuln.today

CVE Published

Jul 16, 2025 - 12:15 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ValvePress Wordpress Auto Spinner wp-auto-spinner allows Reflected XSS.This issue affects Wordpress Auto Spinner: from n/a through <= 3.26.0.

AnalysisAI

Reflected cross-site scripting (XSS) in ValvePress WordPress Auto Spinner plugin versions up to 3.26.0 allows unauthenticated remote attackers to inject malicious scripts into web pages viewed by other users. The vulnerability exploits improper input neutralization during page generation, enabling attackers to steal session tokens, deface content, or redirect users to phishing sites through crafted URLs. No public exploit code has been identified, and exploitation likelihood is assessed as very low (EPSS 0.04%), suggesting this is a low-priority vulnerability despite the XSS classification.

Technical ContextAI

The vulnerability exists in the ValvePress WordPress Auto Spinner plugin, a WordPress plugin designed to automate content spinning and generation. The root cause is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), which indicates the plugin fails to properly sanitize or escape user-supplied input before rendering it in HTML responses. Reflected XSS vulnerabilities of this type typically occur when user input from query parameters, POST data, or headers is directly echoed back to the browser without adequate output encoding, allowing attackers to inject arbitrary JavaScript code that executes in the context of the vulnerable application.

Affected ProductsAI

ValvePress WordPress Auto Spinner plugin through version 3.26.0 is affected. The vulnerability impacts all installations of this WordPress plugin running versions from the initial release through 3.26.0. Users can identify affected installations by checking the plugin version in their WordPress admin dashboard under Plugins. Further details and the vendor advisory are available at the Patchstack vulnerability database entry https://patchstack.com/database/Wordpress/Plugin/wp-auto-spinner/vulnerability/wordpress-wordpress-auto-spinner-plugin-3-25-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve

RemediationAI

Update the WordPress Auto Spinner plugin to the patched version released after 3.26.0 through the WordPress plugin repository or directly via the admin dashboard. If automatic updates are disabled, navigate to Plugins > Installed Plugins, locate WordPress Auto Spinner, and click Update Now. As a temporary mitigation pending patch deployment, administrators should disable the plugin if it is not actively used, or restrict access to administrative pages through IP whitelisting or HTTP authentication. Refer to the Patchstack advisory for confirmation of the patched version number and installation instructions.