What is the CVSS score of CVE-2025-54024?

CVE-2025-54024 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-54024

Q: Which versions of Wordpress Plugin are affected by CVE-2025-54024?

DOM-based cross-site scripting (XSS) in WPAdverts WordPress plugin versions 2.2.5 and earlier allows attackers to inject malicious scripts into web pages viewed by users.

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-07-16 audit@patchstack.com

WordPress XSS Wordpress Plugin

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:42 NVD

6.5 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:43 vuln.today

CVE Published

Jul 16, 2025 - 11:15 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows DOM-Based XSS.This issue affects WPAdverts: from n/a through <= 2.2.5.

AnalysisAI

DOM-based cross-site scripting (XSS) in WPAdverts WordPress plugin versions 2.2.5 and earlier allows attackers to inject malicious scripts into web pages viewed by users. The vulnerability enables arbitrary JavaScript execution in the context of affected websites, potentially leading to session hijacking, credential theft, or malware distribution. No active exploitation has been confirmed, and EPSS probability remains low at 0.04%.

Technical ContextAI

WPAdverts is a WordPress plugin for managing classified advertisements. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), which encompasses cross-site scripting flaws. DOM-based XSS occurs when user-controlled input is processed by client-side JavaScript and inserted into the DOM without proper sanitization or encoding, allowing an attacker to control script execution in a victim's browser. This differs from stored or reflected XSS in that the payload manipulation occurs entirely on the client side, often through URL parameters or local storage manipulation that the vulnerable JavaScript then processes unsafely.

Affected ProductsAI

WPAdverts WordPress plugin versions 2.2.5 and earlier are affected. The plugin is maintained by Greg Winiarski and is distributed through the WordPress plugin repository. Organizations running any version up to and including 2.2.5 should evaluate their exposure. Detailed vendor advisory and vulnerability specifics are available via the Patchstack database reference provided.

RemediationAI

Update WPAdverts to a version newer than 2.2.5 immediately; consult the plugin's official repository or Patchstack advisory for the exact patched version number. If an immediate upgrade is not possible, review WordPress security hardening practices including Content Security Policy (CSP) headers, which can mitigate DOM-based XSS impact by restricting inline script execution. The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wpadverts contains specific remediation guidance and may reference a patched version number.