What is the CVSS score of CVE-2025-48279?

CVE-2025-48279 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by CVE-2025-48279?

A reflected cross-site scripting (XSS) vulnerability in WC MyParcel Belgium plugin (versions 4.5.5 through beta) allows attackers to inject malicious scripts that execute in users' browsers,…

How to fix or mitigate CVE-2025-48279?

Within 24 hours: Identify all WordPress instances running WC MyParcel Belgium and document current plugin versions; disable the plugin if not critical to operations, or restrict access to trusted networks only. Within 7 days: Implement Web Application Firewall (WAF) rules to block malicious XSS payloads and monitor for exploitation attempts; contact the vendor for patch timeline and security updates. Within 30 days: Upgrade to a patched version immediately upon availability; conduct security audit of affected systems for evidence of prior exploitation.

Wordpress Plugin CVE-2025-48279

EUVD-2025-17538 HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-06-09 audit@patchstack.com

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17538

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Richard Perdaan WC MyParcel Belgium allows Reflected XSS. This issue affects WC MyParcel Belgium: from 4.5.5 through beta.

AnalysisAI

Reflected Cross-Site Scripting (XSS) vulnerability in the WC MyParcel Belgium WordPress plugin (versions 4.5.5 through beta) that allows unauthenticated attackers to inject arbitrary JavaScript into web pages viewed by users. An attacker can craft a malicious URL to execute scripts in a victim's browser within the context of the affected website, potentially stealing session cookies, performing unauthorized actions, or redirecting users to phishing sites. The CVSS 7.1 score reflects moderate severity with network-based attack vector, no privilege requirements, and user interaction dependency; active exploitation status and POC availability are currently unknown from public sources.

Technical ContextAI

This vulnerability exploits improper input sanitization in the WC MyParcel Belgium plugin, which is a WordPress extension for e-commerce shipping integration with MyParcel (a Belgian parcel delivery service). The root cause is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), indicating that user-supplied input is reflected directly into HTTP responses without proper encoding or validation. The affected product likely processes URL parameters or form data that are then rendered in HTML contexts without escaping special characters (such as <, >, ", '). This is a classic Reflected XSS vulnerability where the malicious payload must be delivered via a crafted URL or form submission, distinguishing it from Stored XSS. The WordPress plugin architecture suggests the vulnerability exists in a page handler, AJAX endpoint, or parameter processing function within the plugin's codebase.

RemediationAI

Immediate actions: (1) Update WC MyParcel Belgium to the latest stable release beyond beta that includes XSS input validation fixes - contact Richard Perdaan or check the WordPress.org plugin repository for patched versions; (2) If no patch is available, disable the WC MyParcel Belgium plugin temporarily and switch to an alternative shipping integration method; (3) Implement Web Application Firewall (WAF) rules to detect and block reflected XSS payloads in URL parameters commonly used by the plugin; (4) Apply WordPress security hardening: update WordPress core, all plugins, and themes to latest versions, and enable Content Security Policy (CSP) headers to restrict inline script execution. Long-term: Monitor the official plugin repository and vendor security advisories for patch releases. Developers should review and patch input validation in page handlers, AJAX endpoints, and template rendering functions to use proper output encoding functions (e.g., esc_attr(), esc_html(), wp_kses_post() in WordPress).