What is the CVSS score of CVE-2025-49958?

CVE-2025-49958 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Robokassa WooCommerce are affected by CVE-2025-49958?

Robokassa payment gateway for WooCommerce (versions 1.8.5 and earlier) contains a reflected cross-site scripting vulnerability that could allow attackers to hijack admin sessions or intercept…

How to fix or mitigate CVE-2025-49958?

Within 24 hours: Identify all WooCommerce installations using Robokassa plugin and document affected versions. Within 7 days: Disable or remove the Robokassa plugin if not business-critical; if required, isolate affected WooCommerce instances behind additional authentication or WAF rules blocking script injection patterns. Within 30 days: Monitor Robokassa vendor advisories for patch availability and test thoroughly before deployment; consider switching to alternative payment gateways with active security support.

Robokassa WooCommerce CVE-2025-49958

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-10-22 audit@patchstack.com

WordPress XSS

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 01:14 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Oct 22, 2025 - 15:15 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robokassa Robokassa payment gateway for Woocommerce robokassa allows Reflected XSS.This issue affects Robokassa payment gateway for Woocommerce: from n/a through <= 1.8.5.

AnalysisAI

Reflected cross-site scripting in Robokassa payment gateway for WooCommerce (versions ≤1.8.5) allows remote attackers to execute malicious JavaScript in victim browsers through specially crafted URLs. The scope-change CVSS flag indicates attackers can impact resources beyond the vulnerable plugin itself, potentially compromising WooCommerce admin sessions or customer payment data. EPSS probability is low (0.03%, 8th percentile), and no active exploitation or public POC has been identified at time of analysis.

Technical ContextAI

The vulnerability stems from improper neutralization of user-supplied input before rendering it in dynamically generated web pages (CWE-79). The Robokassa plugin integrates a Russian payment gateway into WooCommerce-powered e-commerce sites. Reflected XSS occurs when the plugin fails to sanitize URL parameters, query strings, or POST data before echoing them into HTML responses. The changed scope (S:C) in the CVSS vector indicates the vulnerable component operates under one security authority (the WordPress plugin) but can affect resources governed by a different authority (WooCommerce core, WordPress admin interface, or user browsers), enabling session hijacking or data exfiltration beyond the plugin's immediate context.

Affected ProductsAI

The vulnerability affects the Robokassa payment gateway for WooCommerce WordPress plugin, all versions from the initial release through version 1.8.5 inclusive. This is a third-party integration plugin developed by the robokassa vendor to enable Russian Robokassa payment processing in WooCommerce online stores. The plugin is distributed through the WordPress plugin repository. Patchstack vulnerability database entry available at https://patchstack.com/database/Wordpress/Plugin/robokassa/vulnerability/wordpress-robokassa-payment-gateway-for-woocommerce-plugin-1-7-3-cross-site-scripting-xss-vulnerability provides additional technical details, though the URL references version 1.7.3 while the CVE scope extends through 1.8.5.

RemediationAI

Upgrade the Robokassa payment gateway for WooCommerce plugin to a version newer than 1.8.5 that addresses this XSS vulnerability. Check the WordPress plugin repository or contact the vendor directly for the patched release, as the exact fix version is not independently confirmed in NVD data at time of analysis. Until a patch is applied, implement compensating controls: configure Content Security Policy headers to restrict inline script execution and limit script-src directives to trusted domains only (trade-off: may break legitimate plugin functionality requiring inline scripts); educate WooCommerce administrators to never click links in unsolicited payment-related emails and to manually type admin URLs; enable WordPress two-factor authentication to limit impact of session token theft; review web application firewall rules to detect and block reflected XSS patterns in query parameters, though this may generate false positives on legitimate encoded payment data. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/robokassa/vulnerability for vendor-specific guidance and IOCs.