What is the CVSS score of CVE-2025-49266?

CVE-2025-49266 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by CVE-2025-49266?

A reflected cross-site scripting (XSS) vulnerability in Rustaurius Ultimate Reviews (versions through 3.2.14) allows attackers to inject malicious code that executes in users' browsers, potentially…

How to fix or mitigate CVE-2025-49266?

Within 24 hours: Identify all WordPress installations running Ultimate Reviews and document affected versions; disable user-facing review submission forms if possible. Within 7 days: Implement Web Application Firewall (WAF) rules to block common XSS payloads targeting review input fields; enforce Content Security Policy (CSP) headers; educate users about phishing risks. Within 30 days: Monitor vendor communications for patch release; prepare emergency deployment procedures; evaluate alternative review plugins; conduct security audit of review data for signs of compromise.

Wordpress Plugin CVE-2025-49266

EUVD-2025-28292 HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-06-17 audit@patchstack.com

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-28292

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 15:15 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Ultimate Reviews allows Reflected XSS. This issue affects Ultimate Reviews: from n/a through 3.2.14.

AnalysisAI

Reflected Cross-Site Scripting (XSS) vulnerability in Rustaurius Ultimate Reviews WordPress plugin versions up to 3.2.14, allowing unauthenticated attackers to inject malicious scripts that execute in users' browsers. The vulnerability requires user interaction (clicking a malicious link) but can compromise session tokens, steal sensitive data, or perform actions on behalf of affected users. While this is a network-accessible, low-complexity attack with moderate CVSS score (7.1), reflected XSS vulnerabilities are commonly exploited and proof-of-concept code is typically straightforward to develop.

Technical ContextAI

This vulnerability exists in the Rustaurius Ultimate Reviews WordPress plugin (CPE: wp:rustaurius:ultimate_reviews), a widely-used review management system for WordPress. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input is reflected back into the HTML response without proper sanitization or encoding. WordPress plugins typically fail to validate and escape user input in query parameters, POST data, or custom fields before rendering them in page output. The vulnerable code path likely processes user input through functions without calling proper WordPress sanitization functions (wp_kses_post, esc_html, esc_attr, etc.) or relying on outdated sanitization methods. An attacker crafts a URL containing JavaScript payload (e.g., ?param=<script>alert('XSS')</script>) which the plugin echoes back unsanitized, causing the browser to execute the script in the context of the vulnerable site.

RemediationAI

Immediate actions: (1) Update Rustaurius Ultimate Reviews to version 3.2.15 or later (patch version not explicitly stated in CVE; verify via WordPress.org or vendor). (2) If update unavailable, disable the Ultimate Reviews plugin temporarily until patched. (3) If immediate patching is impossible, implement WAF (Web Application Firewall) rules to block requests containing common XSS payloads (script tags, event handlers, javascript: protocol). Short-term: Review server logs for exploit attempts using patterns like '<script', 'onerror=', 'onclick=' in query parameters. Verify no user sessions were compromised and reset admin passwords. Long-term: Implement WordPress security best practices—run regular plugin audits with tools like WPScan, enable automatic plugin updates, use security plugins (Wordfence, Sucuri), restrict admin access via IP allowlisting, and enforce Content Security Policy (CSP) headers to mitigate XSS impact.