What is the CVSS score of CVE-2025-62140?

CVE-2025-62140 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-62140

Q: Which versions of Wordpress Plugin are affected by CVE-2025-62140?

Stored cross-site scripting (XSS) in plainware Locatoraid Store Locator WordPress plugin versions up to 3.9.68 allows attackers to inject malicious scripts into web pages viewed by other users.

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-12-31 audit@patchstack.com

WordPress XSS Wordpress Plugin

5.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

5.9 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 31, 2025 - 14:15 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in plainware Locatoraid Store Locator locatoraid allows Stored XSS.This issue affects Locatoraid Store Locator: from n/a through <= 3.9.68.

AnalysisAI

Stored cross-site scripting (XSS) in plainware Locatoraid Store Locator WordPress plugin versions up to 3.9.68 allows attackers to inject malicious scripts into web pages viewed by other users. The vulnerability affects the plugin's input handling during web page generation, enabling persistent XSS attacks. With an EPSS score of 0.01% and no active exploitation confirmed, this represents a low-probability but persistent risk requiring plugin updates.

Technical ContextAI

The vulnerability stems from improper neutralization of user input (CWE-79) in the Locatoraid Store Locator plugin, a WordPress extension used to display store location information. The plugin fails to adequately sanitize or escape user-supplied data before rendering it in HTML output, allowing attackers to embed arbitrary JavaScript that executes in the browser context of subsequent users viewing the affected content. This is a stored XSS variant, meaning the malicious payload persists in the application database and affects all users who access the compromised data, unlike reflected XSS which requires per-victim delivery.

Affected ProductsAI

The plainware Locatoraid Store Locator WordPress plugin is affected in all versions from an unspecified baseline through version 3.9.68 inclusive. The plugin serves as a geolocation tool for WordPress sites to display store locations to visitors. Exact CPE information is not independently confirmed in the provided references, though the vulnerability is documented in the Patchstack vulnerability database under the WordPress plugin category.

RemediationAI

Upgrade the Locatoraid Store Locator plugin to a version newer than 3.9.68 immediately. Check the official WordPress plugin repository or the vendor's update mechanism for the latest patched release. If automatic plugin updates are enabled, the patch should be deployed automatically; otherwise, administrators should manually trigger the update through the WordPress dashboard (Plugins → Updates). Until patching is complete, restrict plugin functionality or disable the plugin if not actively in use. The vulnerability details and remediation guidance are available via the Patchstack advisory referenced in the vulnerability database.