What is the CVSS score of CVE-2025-52786?

CVE-2025-52786 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-52786

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-07-16 audit@patchstack.com

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:42 NVD

7.1 (HIGH)

Analysis Generated

Apr 01, 2026 - 17:43 vuln.today

CVE Published

Jul 16, 2025 - 12:15 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kingdom Creation Media Folder media-folder allows Reflected XSS.This issue affects Media Folder: from n/a through <= 1.0.0.

AnalysisAI

Reflected cross-site scripting (XSS) in Kingdom Creation Media Folder WordPress plugin versions through 1.0.0 allows unauthenticated attackers to inject malicious scripts into web pages viewed by other users. The vulnerability exists in input handling during page generation and can be exploited by crafting specially-formed URLs, enabling session hijacking, credential theft, or malware distribution without requiring authentication or user interaction beyond visiting a malicious link.

Technical ContextAI

This is a classic reflected XSS vulnerability (CWE-79) in a WordPress plugin, where user-supplied input is not properly neutralized before being rendered in the HTML response. The Media Folder plugin (WordPress CPE not explicitly provided but referenced as 'Kingdom Creation Media Folder') fails to sanitize or escape query parameters or form inputs during dynamic page generation. Reflected XSS differs from stored XSS in that the payload is not persisted in a database; instead, it travels through the request itself (typically via URL query string or POST parameters). The vulnerability allows attackers to execute arbitrary JavaScript in the context of the victim's browser session, potentially accessing session tokens, cookies, or performing actions on behalf of the user.

Affected ProductsAI

Kingdom Creation Media Folder WordPress plugin versions 1.0.0 and earlier are affected. The plugin is distributed through the WordPress plugin repository and managed by the Patchstack vulnerability database (reference: Patchstack WordPress Media Folder vulnerability listing).

RemediationAI

Upgrade Kingdom Creation Media Folder to a version newer than 1.0.0 as soon as a patched release is available from the developer. Users should verify the plugin's WordPress.org page or contact the Kingdom Creation Media Folder development team for the specific patched version number. As an interim workaround pending patch availability, disable the Media Folder plugin if it is not critical to operations, or restrict access to the plugin's functionality through WordPress user role management and .htaccess rules. Input validation and output escaping should be verified by the vendor in the updated release. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/media-folder/vulnerability/wordpress-media-folder-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve for additional technical details and any vendor-provided fixes.