What is the CVSS score of CVE-2025-52790?

CVE-2025-52790 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by CVE-2025-52790?

A high-severity CSRF/XSS vulnerability in the WP-DownloadCounter WordPress plugin (versions through 1.01) allows attackers to inject malicious scripts that execute in users' browsers, potentially…

How to fix or mitigate CVE-2025-52790?

Within 24 hours: Audit all WordPress installations for WP-DownloadCounter plugin presence and document affected systems. Within 7 days: Either disable the plugin entirely or implement WAF rules blocking requests to vulnerable plugin endpoints; apply input validation rules to sanitize download counter parameters. Within 30 days: Identify alternative download counter solutions and migrate away from WP-DownloadCounter; monitor WordPress plugin repository for patch release and establish process to apply immediately upon availability.

Wordpress Plugin CVE-2025-52790

EUVD-2025-28465 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-06-20 audit@patchstack.com

WordPress XSS CSRF Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-28465

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

CVE Published

Jun 20, 2025 - 15:15 nvd

HIGH 7.1

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in r-win WP-DownloadCounter allows Stored XSS. This issue affects WP-DownloadCounter: from n/a through 1.01.

AnalysisAI

CVE-2025-52790 is a CSRF vulnerability in the r-win WP-DownloadCounter WordPress plugin (versions through 1.01) that enables Stored XSS attacks. An attacker can craft malicious requests that, when clicked by an administrator, inject persistent JavaScript into the plugin's data storage, affecting all site visitors. The CVSS 7.1 score reflects moderate severity with network-based attack delivery and user interaction requirements, though the actual exploitability and active exploitation status require verification against KEV and EPSS data.

Technical ContextAI

WP-DownloadCounter is a WordPress plugin (CPE likely: cpe:2.3:a:r-win:wp-downloadcounter) that manages and tracks file downloads. The vulnerability combines two attack classes: CWE-352 (Cross-Site Request Forgery) and Stored XSS. The root cause is insufficient CSRF token validation and output encoding in plugin functionality. When a CSRF request is processed without proper nonce verification, attacker-supplied input is stored in the plugin's database without sanitization. Subsequent retrieval and rendering of this data to administrators or users results in arbitrary JavaScript execution. The vulnerability affects WordPress plugin architecture where POST/GET parameters controlling download metadata, settings, or logs are not adequately protected by WordPress nonces or verified for origin.

RemediationAI

action: Update Plugin; details: Upgrade r-win WP-DownloadCounter to version 1.02 or later (assume patched version exists post-1.01; verify via wordpress.org plugin repository or vendor advisory).
action: CSRF Protection; details: Ensure all plugin forms implement WordPress nonce validation (wp_verify_nonce()) on POST requests. This blocks CSRF exploitation by validating origin-specific tokens.
action: Output Encoding; details: Sanitize and escape all user-supplied data before storage (sanitize_text_field(), wp_kses_post()) and before display (esc_html(), esc_attr(), wp_kses_post()). This prevents Stored XSS.
action: Immediate Workaround; details: If patch unavailable, disable r-win WP-DownloadCounter until patched version is released, or restrict admin access via .htaccess/firewall rules to minimize CSRF attack surface.
action: Verify Patch; details: Check WordPress.org plugin repository (wordpress.org/plugins/wp-downloadcounter) for version history and security notices. Review vendor advisories from r-win.