What is the CVSS score of CVE-2025-47652?

CVE-2025-47652 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-47652

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-07-16 audit@patchstack.com

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:42 NVD

7.1 (HIGH)

Analysis Generated

Apr 01, 2026 - 17:43 vuln.today

CVE Published

Jul 16, 2025 - 12:15 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infility Infility Global infility-global allows Reflected XSS.This issue affects Infility Global: from n/a through <= 2.13.4.

AnalysisAI

Reflected cross-site scripting (XSS) in Infility Global WordPress plugin through version 2.13.4 allows unauthenticated remote attackers to inject malicious scripts into web pages viewed by other users. The vulnerability stems from improper input neutralization during page generation, enabling attackers to steal session cookies, perform actions on behalf of users, or redirect victims to malicious sites. No public exploit code or active exploitation has been confirmed at the time of analysis, though the low EPSS score (0.04%) suggests limited practical exploitation likelihood despite the XSS attack vector.

Technical ContextAI

This is a reflected XSS vulnerability (CWE-79) in the Infility Global WordPress plugin, a content management plugin for WordPress. The root cause is improper neutralization of user-supplied input before rendering it in HTML context during web page generation. Reflected XSS vulnerabilities occur when untrusted data is echoed back to the browser in HTTP responses without proper encoding or sanitization, allowing attackers to craft malicious URLs that execute arbitrary JavaScript in the victim's browser. The vulnerability affects the plugin versions through 2.13.4, suggesting that user input parameters are being rendered directly into page output without escaping HTML special characters or applying content security measures.

Affected ProductsAI

Infility Global WordPress plugin is affected in all versions from an unspecified baseline through version 2.13.4. The plugin is distributed via the official WordPress plugin repository and is identified by the slug 'infility-global'. CPE information is not provided in the available data, but WordPress installations with this plugin installed and activated are at risk. For full advisory details, refer to the Patchstack vulnerability database entry at https://patchstack.com/database/Wordpress/Plugin/infility-global/vulnerability/wordpress-infility-global-plugin-2-11-2-reflected-cross-site-scripting-xss-vulnerability.

RemediationAI

Update Infility Global WordPress plugin to a version beyond 2.13.4 immediately. The exact patched version number is not specified in the available data; consult the official plugin repository or the Patchstack advisory for the recommended upgrade version. After updating, test the plugin's functionality to ensure compatibility with your WordPress theme and other plugins. As an interim measure before patching, restrict access to pages that may be vulnerable to XSS (if known) and educate users not to click on suspicious links from untrusted sources. Additionally, implement a Web Application Firewall (WAF) rule to detect and block common XSS payloads if feasible. See https://patchstack.com/database/Wordpress/Plugin/infility-global/vulnerability/wordpress-infility-global-plugin-2-11-2-reflected-cross-site-scripting-xss-vulnerability for additional guidance.