What is the CVSS score of CVE-2025-52779?

CVE-2025-52779 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-52779

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-07-16 audit@patchstack.com

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:42 NVD

7.1 (HIGH)

Analysis Generated

Apr 01, 2026 - 17:43 vuln.today

CVE Published

Jul 16, 2025 - 12:15 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in karimmughal Dot html,php,xml etc pages dot-htmlphpxml-etc-pages allows Reflected XSS.This issue affects Dot html,php,xml etc pages: from n/a through <= 1.0.

AnalysisAI

Reflected cross-site scripting (XSS) in the WordPress plugin Dot html,php,xml etc pages version 1.0 and earlier allows unauthenticated attackers to inject malicious scripts into web pages viewed by other users. The vulnerability stems from improper input neutralization during page generation, enabling attackers to execute arbitrary JavaScript in victims' browsers. While a public advisory exists, the EPSS score of 0.04% indicates low exploitation probability, and no active exploitation or public proof-of-concept has been confirmed.

Technical ContextAI

The vulnerability is a reflected XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) in a WordPress plugin that processes HTML, PHP, XML, and other page types. The root cause is insufficient sanitization of user-supplied input before rendering it in web page output. Reflected XSS occurs when untrusted input is echoed back to the user's browser without escaping or validation, allowing attackers to inject HTML and JavaScript payloads. The affected plugin (CPE data not provided in sources) is a WordPress plugin authored by karimmughal that handles multiple file type formats.

Affected ProductsAI

The vulnerable product is the WordPress plugin "Dot html,php,xml etc pages" version 1.0 and all earlier versions, authored by karimmughal. The plugin is distributed through WordPress.org and processes multiple file type formats. Specific CPE data was not provided in available references, but the advisory is documented in the Patchstack vulnerability database for WordPress plugins.

RemediationAI

Users should upgrade the "Dot html,php,xml etc pages" plugin to a patched version released after 1.0. For current version status and exact patch availability, refer to the official advisory at https://patchstack.com/database/Wordpress/Plugin/dot-htmlphpxml-etc-pages/vulnerability/wordpress-dot-html-php-xml-etc-pages-1-0-cross-site-scripting-xss-vulnerability. If the plugin is no longer maintained or a patch is unavailable, consider replacing it with an actively maintained alternative that properly sanitizes input. As an interim measure, restrict plugin functionality or disable it until patched. Website administrators should audit user input handling across all custom pages and ensure output encoding is applied consistently using WordPress sanitization functions (e.g., wp_kses_post, esc_html).