What is the CVSS score of CVE-2025-47554?

CVE-2025-47554 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-47554

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-07-16 audit@patchstack.com

WordPress XSS

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:42 NVD

7.1 (HIGH)

Analysis Generated

Apr 01, 2026 - 17:43 vuln.today

CVE Published

Jul 16, 2025 - 12:15 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs CSS3 Compare Pricing Tables for WordPress css3_web_pricing_tables_grids allows Reflected XSS.This issue affects CSS3 Compare Pricing Tables for WordPress: from n/a through <= 11.6.

AnalysisAI

Reflected cross-site scripting (XSS) in the CSS3 Compare Pricing Tables for WordPress plugin through version 11.6 allows unauthenticated remote attackers to inject malicious scripts into web pages viewed by other users. The vulnerability stems from improper input neutralization during web page generation, enabling attackers to steal session cookies, perform actions on behalf of victims, or redirect users to malicious sites through specially crafted URLs. No public exploit code or active exploitation has been confirmed, and the low EPSS score (0.04%, 13th percentile) suggests limited real-world attack likelihood despite the XSS vector.

Technical ContextAI

The vulnerability is a CWE-79 (Improper Neutralization of Input During Web Page Generation) reflected XSS flaw in a WordPress plugin used to display pricing table grids. The plugin fails to sanitize or validate user-supplied input before echoing it back in HTTP responses, allowing attackers to inject arbitrary JavaScript that executes in the context of the victim's browser. Reflected XSS differs from stored XSS in that it requires victims to click a malicious link; the payload is not permanently stored on the server. The affected product is the CSS3 Compare Pricing Tables for WordPress plugin (CPE context: WordPress plugin slug 'css3_web_pricing_tables_grids') versions up to and including 11.6.

Affected ProductsAI

The CSS3 Compare Pricing Tables for WordPress plugin, developed by QuanticaLabs, is affected in versions from an unspecified baseline through version 11.6. The plugin is identified by the WordPress plugin slug 'css3_web_pricing_tables_grids'. Further details are available in the Patchstack vulnerability database entry linked in the references.

RemediationAI

Update the CSS3 Compare Pricing Tables for WordPress plugin to a version newer than 11.6 as soon as a patched release is available from the plugin vendor. Website administrators should check the plugin's release history on WordPress.org or the vendor's site for the next available version. In the interim, consider disabling the plugin if it is not actively required, or restrict access to pricing table pages if possible. Users should also educate their audience to avoid clicking suspicious links that could deliver the XSS payload. For current vulnerability details and patch availability confirmation, refer to the Patchstack database entry at https://patchstack.com/database/Wordpress/Plugin/css3_web_pricing_tables_grids/vulnerability/wordpress-css3-compare-pricing-tables-for-wordpress-plugin-11-6-reflected-cross-site-scripting-xss-vulnerability.