What is the CVSS score of CVE-2025-48096?

CVE-2025-48096 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Custom CSS CVE-2025-48096

Q: Which versions of Custom CSS are affected by CVE-2025-48096?

Unauthenticated access in the Custom CSS plugin for WordPress up to version 1.4.0 allows attackers to inject arbitrary CSS or cause service disruption due to a missing authorization check.

MEDIUM

Missing Authorization (CWE-862)

2025-10-22 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network attack with no authentication or user interaction, limited to integrity and availability impacts.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 18:45 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in FRESHFACE Custom CSS custom-css-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom CSS: from n/a through <= 1.4.0.

AnalysisAI

Unauthenticated access in the Custom CSS plugin for WordPress up to version 1.4.0 allows attackers to inject arbitrary CSS or cause service disruption due to a missing authorization check. The affected component is the custom-css-editor, which can be triggered remotely without authentication, resulting in partial integrity and availability impact. No active exploitation or public proof-of-concept is known, and the EPSS score of 0.04% indicates low likelihood of widespread attacks.

Technical ContextAI

The vulnerability stems from missing authorization (CWE-862) in the WordPress plugin's AJAX handler or REST API endpoint. Custom CSS is a plugin that lets site administrators add custom stylesheets via a web interface. The exposed endpoint fails to verify user capabilities, allowing any remote user to inject CSS or disrupt the editor. The affected product is the 'custom-css-editor' plugin for WordPress, identified via Patchstack. No CPE is provided, but the vulnerability affects the plugin’s PHP code that processes requests without current_user_can() checks.

Affected ProductsAI

The vulnerability affects the Custom CSS plugin (custom-css-editor) for WordPress versions n/a through 1.4.0. No CPE is listed, but the vulnerability is confirmed by Patchstack. The advisory URL is: https://patchstack.com/database/Wordpress/Plugin/custom-css-editor/vulnerability/wordpress-custom-css-plugin-1-4-0-broken-access-control-vulnerability?_s_id=cve

RemediationAI

Upgrade to version 1.4.1 or later as soon as a patched release is available. At the time of analysis, an explicit fixed version is not confirmed; monitor the WordPress plugin repository or the Patchstack advisory for updates. If an immediate update is not possible, disable the plugin entirely until a fix is released. A temporary workaround is to block access to the admin-ajax.php endpoint or to restrict the vulnerable plugin file via .htaccess, but this may break other legitimate ajax functionality. No complete mitigation short of removal is reliable.