What is the CVSS score of CVE-2025-47566?

CVE-2025-47566 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of ZoomSounds are affected by CVE-2025-47566?

The ZoomSounds WordPress audio player plugin (versions through 6.91) contains a reflected cross-site scripting vulnerability that could expose user credentials and sensitive data when victims click…

How to fix or mitigate CVE-2025-47566?

Within 24 hours, identify all WordPress installations running ZoomSounds 6.91 or earlier and document business dependency on the audio player functionality. Within 7 days, implement interim controls: if the plugin is non-essential, disable it immediately; if required for operations, deploy Web Application Firewall rules to block XSS payloads and monitor access logs for exploit attempts. Within 30 days, either apply the vendor patch (when released) or migrate to an alternative WordPress audio player plugin if the vendor does not release a timely fix.

ZoomSounds CVE-2025-47566

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-12-31 audit@patchstack.com

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-reachable reflected XSS needs no auth (PR:N) but requires the victim to click (UI:R); browser-context script execution crosses into the site origin (S:C) with limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 08:31 vuln.today

CVE Published

Dec 31, 2025 - 20:15 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZoomSounds ZoomSounds dzs-zoomsounds allows Reflected XSS.This issue affects ZoomSounds: from n/a through <= 6.91.

AnalysisAI

Reflected cross-site scripting in the ZoomSounds (dzs-zoomsounds) WordPress audio player plugin, affecting all versions up to and including 6.91, allows remote attackers to inject arbitrary JavaScript that executes in a victim's browser when they interact with a crafted link. Because the CVSS scope is changed (S:C), successful exploitation can impact resources beyond the vulnerable component, and it carries limited confidentiality, integrity, and availability effects. EPSS is very low (0.04%, 14th percentile) and no public exploit identified at time of analysis, indicating limited near-term mass-exploitation likelihood.

Technical ContextAI

The affected component is ZoomSounds (dzs-zoomsounds), a commercial WordPress audio/music player plugin developed by DZS (Digital Zoom Studio). The root cause is CWE-79, Improper Neutralization of Input During Web Page Generation, specifically a reflected variant: user-controllable input is echoed back into an HTTP response page without proper output encoding or input sanitization, so a browser interprets attacker-supplied markup as active script. Reflected XSS is not stored server-side; the malicious payload travels in the request (typically a URL parameter) and is reflected into the immediate response, meaning exploitation requires the victim to load an attacker-crafted request. The vulnerability lives in the plugin's PHP request handling within a WordPress deployment, so the executing context is the WordPress site's origin.

Affected ProductsAI

The affected product is the ZoomSounds (dzs-zoomsounds) WordPress plugin by DZS, in all versions from an unspecified earliest release through and including 6.91 (the input states 'from n/a through <= 6.91'). No CPE string was provided in the intelligence data. Details are documented in the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/dzs-zoomsounds/vulnerability/wordpress-zoomsounds-plugin-6-91-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve, which was the reporting source (audit@patchstack.com).

RemediationAI

No vendor-released patch version is identified in the provided data; the intelligence only confirms affected versions up to and including 6.91, so administrators should check the vendor/CodeCanyon and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/dzs-zoomsounds/vulnerability/wordpress-zoomsounds-plugin-6-91-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve) for a fixed release above 6.91 and upgrade to it once available. As compensating controls until a patched build is confirmed, deploy a web application firewall or Patchstack's virtual patching to filter XSS payloads in requests to the plugin's endpoints, which adds request-inspection overhead and can produce false positives; add or tighten a Content-Security-Policy header to restrict inline script execution, noting this can break legitimate inline scripts and requires testing; and if the plugin is not essential, deactivate and remove it, at the cost of losing the audio-player functionality. Educating users not to click untrusted links reduces the user-interaction trigger but is not a reliable technical control.