What is the CVSS score of CVE-2025-62111?

CVE-2025-62111 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-62111

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-12-31 audit@patchstack.com

WordPress XSS Wordpress Plugin

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

6.5 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 31, 2025 - 13:15 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Extra Shortcodes extra-shortcodes allows Stored XSS.This issue affects Extra Shortcodes: from n/a through <= 2.2.

AnalysisAI

Stored cross-site scripting (XSS) in webvitaly Extra Shortcodes WordPress plugin through version 2.2 allows authenticated attackers to inject malicious scripts that execute in the browsers of other site visitors. The vulnerability stems from improper input neutralization during web page generation, enabling persistence of arbitrary JavaScript code within the plugin's shortcode processing. The low EPSS score (0.04%) and lack of public exploit code suggest limited practical exploitation likelihood, though the stored nature of the vulnerability means injected payloads affect all subsequent visitors until remediated.

Technical ContextAI

The vulnerability exists in the webvitaly Extra Shortcodes plugin for WordPress, a content generation component that processes shortcodes-WordPress macros that expand into dynamic content. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), indicating insufficient input validation or output encoding when processing shortcode parameters. When shortcodes are rendered, user-supplied data is not properly sanitized or escaped before being included in HTML output, allowing attackers to embed script tags or event handlers. This is a stored XSS variant, meaning the malicious payload persists in the WordPress database and executes every time affected content is displayed, rather than requiring per-request injection.

Affected ProductsAI

The webvitaly Extra Shortcodes WordPress plugin is affected in all versions from initial release through version 2.2, distributed via the WordPress.org plugin repository. The plugin is identified by the CPE product family in the plugin ecosystem and can be verified in WordPress admin dashboards. Detailed vulnerability information is available in the Patchstack database at https://patchstack.com/database/Wordpress/Plugin/extra-shortcodes/vulnerability/wordpress-extra-shortcodes-plugin-2-2-cross-site-scripting-xss-vulnerability.

RemediationAI

Update the webvitaly Extra Shortcodes plugin to a version newer than 2.2; consult the plugin's official repository or the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/extra-shortcodes/vulnerability/wordpress-extra-shortcodes-plugin-2-2-cross-site-scripting-xss-vulnerability) for the exact patched version number. If an immediate update is not available, restrict post/page editor roles to trusted administrators only, audit existing posts and pages for suspicious shortcode content or embedded script tags, and disable the plugin if it is not actively required. Review WordPress user capabilities to ensure only authorized users can edit content containing shortcodes.