What is the CVSS score of CVE-2025-48345?

CVE-2025-48345 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-48345

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-07-16 audit@patchstack.com

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:42 NVD

7.1 (HIGH)

Analysis Generated

Apr 01, 2026 - 17:43 vuln.today

CVE Published

Jul 16, 2025 - 12:15 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arisoft Contact Form 7 Editor Button cf7-editor-button allows Reflected XSS.This issue affects Contact Form 7 Editor Button: from n/a through <= 1.0.0.

AnalysisAI

Reflected cross-site scripting (XSS) in Contact Form 7 Editor Button WordPress plugin version 1.0.0 and earlier allows unauthenticated remote attackers to inject malicious scripts into web pages viewed by users. The vulnerability exists in the plugin's input handling during web page generation, enabling attackers to steal session cookies, perform actions on behalf of victims, or redirect users to malicious sites through crafted URLs. No public exploit code or active exploitation has been confirmed at the time of analysis, though the vulnerability is readily exploitable given the low complexity of XSS attacks.

Technical ContextAI

This is a reflected XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) in the Contact Form 7 Editor Button plugin, a WordPress extension designed to enhance the form editing interface. The vulnerability stems from insufficient input sanitization or output encoding when processing user-supplied parameters during page rendering. WordPress plugins interact directly with user input through query strings and form data; failure to properly escape or validate this input before reflecting it back into HTML context allows attackers to inject JavaScript code that executes in the context of a victim's browser session. The affected CPE scope includes the Contact Form 7 Editor Button plugin (WordPress plugin ecosystem) from version 1.0.0 and earlier, suggesting this is a newly discovered flaw in a recent or poorly maintained plugin.

Affected ProductsAI

Contact Form 7 Editor Button WordPress plugin version 1.0.0 and all earlier versions are affected. This is a WordPress plugin (CPE specification would be cpe:2.3:a:arisoft:cf7-editor-button:*:*:*:*:*:wordpress:*:*) distributed through the WordPress plugin repository. Users running version 1.0.0 or prior on WordPress instances are impacted.

RemediationAI

Users should immediately update the Contact Form 7 Editor Button plugin to a patched version released after 1.0.0. Check the plugin's update status within the WordPress admin dashboard and install the latest available version. If no patched version has been released by the plugin maintainer at the time of update, consider disabling the plugin until a security fix is available. For site administrators unable to immediately patch, implement a Web Application Firewall (WAF) rule to filter reflected XSS payloads in query strings, or restrict access to the plugin's functionality to trusted users only. Consult the plugin's advisory page at https://patchstack.com/database/Wordpress/Plugin/cf7-editor-button/vulnerability/wordpress-contact-form-7-editor-button-plugin-1-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve for vendor-specific remediation guidance and patched version availability.