What is the CVSS score of CVE-2025-48143?

CVE-2025-48143 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by CVE-2025-48143?

A cross-site scripting vulnerability in the SalesUp contact form plugin (versions through 1.0.14) allows attackers to inject malicious code that executes in users' browsers when they visit…

How to fix or mitigate CVE-2025-48143?

Within 24 hours: Identify all instances of SalesUp contact form plugin across web properties and document affected systems. Within 7 days: Implement WAF rules to block suspicious input patterns in contact form parameters and disable the plugin if non-critical, or restrict form access to trusted networks only. Within 30 days: Monitor vendor communications for patch availability; conduct security assessment of contact form submissions for evidence of exploitation; develop incident response plan for potential compromised sessions.

Wordpress Plugin CVE-2025-48143

EUVD-2025-17534 HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-06-09 audit@patchstack.com

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17534

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in salesup2019 Formulario de contacto SalesUp! allows Reflected XSS. This issue affects Formulario de contacto SalesUp!: from n/a through 1.0.14.

AnalysisAI

Reflected Cross-Site Scripting (XSS) vulnerability in the SalesUp! Contact Form plugin (versions up to 1.0.14) that allows unauthenticated attackers to inject malicious scripts into web pages viewed by other users. The vulnerability requires user interaction (clicking a malicious link) but can compromise confidentiality, integrity, and availability across security boundaries (CVSS 7.1). There is no indication of active exploitation in the wild or confirmed proof-of-concept at this time based on available intelligence.

Technical ContextAI

This vulnerability stems from improper input neutralization during web page generation (CWE-79: Improper Neutralization of Input During Web Page Generation). The SalesUp! Contact Form plugin (affected versions: n/a through 1.0.14) fails to properly sanitize or encode user-supplied input before rendering it in HTML responses. The plugin, likely a WordPress plugin based on naming conventions, processes contact form submissions or URL parameters without adequate output encoding, enabling attackers to inject arbitrary JavaScript. The reflected nature means the malicious payload is embedded in a URL and executed in the victim's browser session when clicked, potentially stealing session tokens, performing actions on behalf of the user, or redirecting to phishing pages.