What is the CVSS score of CVE-2025-52736?

CVE-2025-52736 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L.

Which versions of Finale Lite are affected by CVE-2025-52736?

The Finale Lite WooCommerce sales countdown timer and discount plugin for WordPress, versions up to and including 2.20.0, contains a reflected cross-site scripting flaw that can be triggered by an…

How to fix or mitigate CVE-2025-52736?

Within 24 hours, inventory all WordPress sites for the Finale Lite plugin (finale-woocommerce-sales-countdown-timer-discount) at versions up to and including 2.20.0 and, if it is not business-critical, disable or remove the plugin. Within 7 days, for sites where the plugin must remain active, deploy WAF rules to block reflected XSS attempts against the plugin’s endpoints, enforce a strict Content Security Policy, restrict WordPress administrative access by IP and role, and require multifactor authentication for all admin users. Within 30 days, monitor the vendor for a patch, test and deploy it immediately upon release, or migrate to a maintained alternative; continue monitoring logs for exploitation attempts and review user awareness guidance on avoiding suspicious links.

Finale Lite CVE-2025-52736

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-10-22 audit@patchstack.com

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Reflected XSS is remotely deliverable (AV:N/AC:L/PR:N) but needs victim click (UI:R); script runs in the browser (S:C) with limited C/I impact and no genuine availability effect, so A:N.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 22:35 vuln.today

CVE Published

Oct 22, 2025 - 15:15 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daman Jeet Finale Lite finale-woocommerce-sales-countdown-timer-discount allows Reflected XSS.This issue affects Finale Lite: from n/a through <= 2.20.0.

AnalysisAI

Reflected cross-site scripting in the WordPress plugin Finale Lite (sold as 'finale-woocommerce-sales-countdown-timer-discount') affects all versions up to and including 2.20.0, letting an attacker reflect unsanitized input back to a victim's browser through the vulnerable plugin endpoint. Per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (7.1), no authentication is required to deliver a payload, but successful exploitation depends on tricking a user into clicking a crafted link or submitting crafted input into a page that echoes it back. There is no public exploit identified at time of analysis and no CISA KEV listing, though the plugin's WooCommerce/e-commerce footprint makes administrative sessions a valuable target; sites running the plugin should treat this as a moderate, interaction-dependent risk.

Technical ContextAI

The underlying issue is CWE-79 (Improper Neutralization of Input During Web Page Generation), the classic cross-site scripting class, in a PHP-based WordPress plugin installed alongside WooCommerce. Finale Lite renders sales countdown timers and discount elements on store pages, and the vulnerable code path reflects attacker-controlled input into the generated HTML response without adequate output encoding or input sanitization. Because the CVSS vector carries S:C (Scope Changed), the injected script executes in the context of the hosting site's origin and can reach resources beyond the vulnerable component itself - for example stealing cookies, session tokens, or performing actions as a logged-in store administrator. The AV:N/AC:L/PR:N portions indicate the payload can be delivered over the network with low complexity and without prior authentication, while UI:R confirms a victim must be induced to click a crafted URL or otherwise submit the malicious input. No CPE strings were supplied in the source data, so exact product identifiers should be taken from the vendor plugin slug 'finale-woocommerce-sales-countdown-timer-discount' and the Patchstack advisory.

Affected ProductsAI

The affected product is the Finale Lite WordPress plugin (plugin slug 'finale-woocommerce-sales-countdown-timer-discount', maintained by Daman Jeet), a WooCommerce sales countdown timer and discount tool. All versions from the earliest release through 2.20.0 inclusive are impacted, meaning any WordPress/WooCommerce site with the plugin installed and active at or below 2.20.0 is in scope. No CPE entries were provided in the intelligence feed, so identification should rely on the plugin slug and version string. The single reference supplied is the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/finale-woocommerce-sales-countdown-timer-discount/vulnerability/wordpress-finale-lite-plugin-2-20-0-cross-site-scripting-xss-vulnerability?_s_id=cve, which is the authoritative source for the affected version range and reporting credit (audit@patchstack.com).

RemediationAI

No vendor-released patch identified at time of analysis: the source data gives only an affected range (<= 2.20.0) with no fixed version, and the single reference is a Patchstack advisory rather than a vendor fix announcement. Administrators should immediately check the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/finale-woocommerce-sales-countdown-timer-discount/vulnerability/wordpress-finale-lite-plugin-2-20-0-cross-site-scripting-xss-vulnerability?_s_id=cve) and the WordPress plugin repository for an updated Finale Lite release and apply it as soon as one is published; if no fixed version is yet available, deactivate and remove the plugin until a patch ships - the trade-off is loss of the countdown-timer/discount functionality on storefront pages. Where the plugin must remain active, deploy a web application firewall rule set that inspects query strings and POST bodies for reflected script payloads targeting the plugin's endpoints, and ensure admin and customer sessions use HttpOnly and Secure cookie flags so that any successfully injected script cannot trivially read session tokens; note that WAF signatures require maintenance and can be bypassed by encoding tricks. Because exploitation requires UI:R, reinforcing user awareness around clicking unsolicited links - particularly links that log administrators into the WordPress dashboard - reduces exposure, but this is a compensating measure and not a substitute for patching once a fix is available.