What is the CVSS score of CVE-2025-54023?

CVE-2025-54023 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-54023

Q: Which versions of Wordpress Plugin are affected by CVE-2025-54023?

DOM-based cross-site scripting (XSS) vulnerability in WP Delicious plugin versions 1.8.4 and earlier allows attackers to inject malicious scripts into web pages viewed by other users.

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-07-16 audit@patchstack.com

WordPress XSS Wordpress Plugin

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:42 NVD

6.5 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:43 vuln.today

CVE Published

Jul 16, 2025 - 11:15 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Delicious WP Delicious delicious-recipes allows DOM-Based XSS.This issue affects WP Delicious: from n/a through <= 1.8.4.

AnalysisAI

DOM-based cross-site scripting (XSS) vulnerability in WP Delicious plugin versions 1.8.4 and earlier allows attackers to inject malicious scripts into web pages viewed by other users. The vulnerability stems from improper neutralization of user input during web page generation, enabling stored or reflected XSS attacks against WordPress sites using the affected plugin. No CVSS score or exploitation data is available, but the low EPSS score (0.04%) suggests limited real-world exploitation probability at the time of analysis.

Technical ContextAI

The vulnerability is classified as DOM-based XSS (CWE-79: Improper Neutralization of Input During Web Page Generation), a class of client-side injection flaw where untrusted user input is processed by JavaScript code within the browser's Document Object Model without proper sanitization or encoding. WP Delicious is a WordPress plugin for recipe management and display (CPE: wp:delicious-recipes). The DOM-based nature indicates the vulnerability likely exists in JavaScript code that directly manipulates the DOM using unsanitized user-supplied data, potentially from URL parameters, form submissions, or stored recipe data. This differs from server-side XSS, as the payload execution occurs entirely on the client side within the user's browser.

Affected ProductsAI

The WP Delicious plugin (delicious-recipes) is affected in all versions from an unspecified baseline through version 1.8.4 inclusive. This includes the WordPress plugin distributed via wordpress.org plugin repository and derivative installations. The exact version range start is not explicitly stated in available data, but the upper bound is confirmed as version 1.8.4 or earlier.

RemediationAI

Update WP Delicious to the latest patched version available from the official WordPress plugin repository. The vulnerability affects versions through 1.8.4, so any version released after 1.8.4 should contain the fix; consult the plugin's changelog or the Patchstack vulnerability advisory (https://patchstack.com/database/Wordpress/Plugin/delicious-recipes/vulnerability/wordpress-wp-delicious-plugin-1-8-4-cross-site-scripting-xss-vulnerability) to identify the exact patched release version. If an immediate patch is unavailable, restrict access to recipe creation and editing functionality to trusted administrator accounts only, and implement Content Security Policy (CSP) headers at the web server level to mitigate DOM-based XSS execution. Regularly audit user-submitted recipe content for suspicious script tags and sanitize output using WordPress-provided escaping functions (esc_html, wp_kses_post).