What is the CVSS score of CVE-2025-5845?

CVE-2025-5845 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-5845

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-07-16 security@wordfence.com

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 19:39 vuln.today

CVE Published

Jul 16, 2025 - 07:15 nvd

MEDIUM 6.4

DescriptionCVE.org

The Affiliate Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘numColumns’ parameter in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in Affiliate Reviews plugin for WordPress (versions up to 1.0.6) allows authenticated attackers with Contributor-level or higher privileges to inject arbitrary JavaScript via the 'numColumns' parameter, which executes in the browsers of any user viewing the affected page. The vulnerability stems from insufficient input sanitization and output escaping in the block-reviews-grid-style.php template. No public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

The Affiliate Reviews WordPress plugin fails to properly sanitize and escape user input in the 'numColumns' parameter before rendering it in the block-reviews-grid-style.php template. This is a Stored XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) where malicious JavaScript is persisted in the WordPress database and executed whenever the affected page is accessed by any user, regardless of privilege level. The vulnerability requires an authenticated user with Contributor-level access or above to inject the payload, but the execution context (Stored XSS) means the payload affects all site visitors. The WordPress plugin ecosystem is a common attack surface due to the prevalence of plugins with variable security standards and widespread WordPress installations.

Affected ProductsAI

Affiliate Reviews plugin for WordPress versions 1.0.6 and earlier are affected. The plugin is distributed through the official WordPress.org plugin repository (https://wordpress.org/plugins/affiliate-reviews/). The vulnerable code is present in the block-reviews-grid-style.php template file as referenced in the WordPress plugin repository browser and changeset 3345717. No CPE identifier is available in the provided data, but the affected software can be identified by plugin slug 'affiliate-reviews' with version number up to and including 1.0.6.

RemediationAI

Update the Affiliate Reviews plugin to version 1.0.7 or later, which addresses the input sanitization and output escaping issues in the 'numColumns' parameter. This patch was released via WordPress plugin repository changeset 3345717 (https://plugins.trac.wordpress.org/changeset/3345717/). Site administrators should verify plugin updates are enabled and apply the patch immediately. Until patching is possible, temporarily disable or deactivate the Affiliate Reviews plugin to prevent exploitation. Review and audit any pages or posts that used the Affiliate Reviews block with the 'numColumns' parameter to identify and remove any injected malicious scripts. Restrict Contributor-level and Editor-level account creation to trusted users only, and implement regular user access reviews. Additional context and vulnerability details are available from Wordfence (https://www.wordfence.com/threat-intel/vulnerabilities/id/ccd11b05-feb0-4e32-b11d-9c8f10ddf30a?source=cve).