What is the CVSS score of CVE-2025-49911?

CVE-2025-49911 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Vehicle Parts Finder are affected by CVE-2025-49911?

WooCommerce Vehicle Parts Finder (versions up to and including 3.7) carries an unpatched reflected cross-site scripting flaw rated HIGH (CVSS 7.1) that allows script execution in the browser session…

How to fix or mitigate CVE-2025-49911?

Within 24 hours, inventory every WordPress installation running WooCommerce Vehicle Parts Finder and confirm which sites are on versions up to and including 3.7, then subscribe to the Patchstack advisory and the plugin vendor's release channel because no vendor-released patch has been identified at time of analysis. Within 7 days, deactivate and remove the plugin where it is not operationally required; where it is required, implement virtual patching at the WAF/CDN edge to block reflected script-injection payloads to the plugin's endpoints and rate-limit or filter requests carrying script content. Within 30 days, re-check for a fixed release and upgrade immediately if one ships; if none has shipped, formally register a compensating-control exception with monthly review, verify logging and alerting on administrator sessions, and brief administrators and shop managers to avoid opening unsolicited links while logged in.

Vehicle Parts Finder CVE-2025-49911

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-10-22 audit@patchstack.com

WordPress XSS Woocommerce Wordpress Plugin

7.1

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Reflected XSS is network-delivered and unauthenticated (AV:N/PR:N) but needs victim click (UI:R); payload runs in the victim browser, changing scope (S:C) with limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Metadata Corrected

Oct 08, 2026 - 13:40 vuln.today

tag: Woocommerce added

Analysis Generated

Oct 08, 2026 - 13:21 vuln.today

CVE Published

Oct 22, 2025 - 15:15 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpinstinct WooCommerce Vehicle Parts Finder woo-vehicle-parts-finder allows Reflected XSS.This issue affects WooCommerce Vehicle Parts Finder: from n/a through <= 3.7.

AnalysisAI

Reflected cross-site scripting in the WordPress plugin WooCommerce Vehicle Parts Finder (versions up to and including 3.7) lets remote attackers inject script into a page generated from unsanitized input, which executes in the browser of any user who opens a crafted link. Exploitation requires victim interaction - the attacker only delivers a URL, so a site administrator or shop manager with an active logged-in session is the highest-value target, and the plugin's narrow install base further limits real-world impact. Risk signals are low: EPSS is 0.23% (12th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis; no vendor-released patch was identified in the available data, so the Patchstack advisory should be monitored for a fixed release even though patching guidance is not yet confirmed.

Technical ContextAI

The affected component is a third-party WordPress/WooCommerce extension written in PHP that renders vehicle-parts search and filtering output into HTML pages. The root cause is CWE-79, improper neutralization of user-supplied input during web page generation: a request parameter is echoed back into the response without adequate HTML escaping, so markup supplied by the attacker is parsed by the victim's browser in the context of the affected site's origin. The assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L confirms a network-reachable, low-complexity, unauthenticated vector that nevertheless requires user interaction (UI:R), with scope changed (S:C) because the injected script runs against the site's origin and can act on behalf of the victim. Reflected rather than stored behavior means there is no persistence: the payload lives only in the delivered link and must be re-sent for each attempt. The specific vulnerable parameter and endpoint are not disclosed in the available data, and no CPE strings were supplied to narrow the affected build set beyond the plugin slug woo-vehicle-parts-finder.

Affected ProductsAI

The WordPress plugin WooCommerce Vehicle Parts Finder (slug woo-vehicle-parts-finder) is affected in all versions from the earliest release through and including 3.7, per the plugin advisory at https://patchstack.com/database/Wordpress/Plugin/woo-vehicle-parts-finder/vulnerability/wordpress-woocommerce-vehicle-parts-finder-plugin-3-7-cross-site-scripting-xss-vulnerability?_s_id=cve. Because the vendor advisory states the range as 'n/a through <= 3.7', every deployment running version 3.7 or older is in scope until a fixed build is published; no fixed version or CPE identifiers were provided in the available data, and any WordPress or WooCommerce site with this plugin active should be inventoried and version-checked immediately.

RemediationAI

No vendor-released patch was identified in the available data, and no fixed version number is given in the Patchstack advisory, so verify the current plugin version and watch https://patchstack.com/database/Wordpress/Plugin/woo-vehicle-parts-finder/ for an updated release before assuming a safe upgrade path. Until a fix is confirmed, the most effective control is to deactivate and remove WooCommerce Vehicle Parts Finder from production sites - this fully closes the issue at the cost of losing the vehicle-parts finder storefront functionality. If removal is not feasible, restrict the plugin's shortcodes and public search/filter endpoints so they are not reachable from untrusted traffic, and treat every URL containing plugin parameters as untrusted: because exploitation requires the victim to open a link (UI:R), training administrators and shop managers to avoid following unsolicited links while authenticated materially reduces risk, as does enforcing a strict Content-Security-Policy that blocks inline script. A WAF or reverse-proxy rule that inspects and rejects script-bearing payloads in the plugin's request parameters can provide interim filtering, but it carries a high false-negative risk against encoding tricks and adds operational overhead; none of these compensating controls should be treated as equivalent to a vendor patch.