What is the CVSS score of CVE-2025-6261?

CVE-2025-6261 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-6261

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-07-23 security@wordfence.com

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 18:38 vuln.today

CVE Published

Jul 23, 2025 - 03:15 nvd

MEDIUM 6.4

DescriptionCVE.org

The Fleetwire Fleet Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fleetwire_list shortcode in all versions up to, and including, 1.0.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in Fleetwire Fleet Management WordPress plugin versions up to 1.0.19 allows authenticated contributors and above to inject malicious scripts via the fleetwire_list shortcode due to insufficient input sanitization and output escaping. When site visitors access pages containing the injected shortcode, the attacker's scripts execute in their browsers with access to session cookies and site functionality, enabling credential theft, malware distribution, or defacement. No public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

The vulnerability stems from improper handling of user-supplied attributes in the fleetwire_list shortcode (CWE-79: Improper Neutralization of Input During Web Page Generation). WordPress shortcodes are processed server-side when pages or posts are rendered, and the plugin fails to properly sanitize attribute inputs and escape output before rendering HTML. An authenticated user with contributor-level permissions can save malicious payloads in post/page content; when that content is accessed by any visitor (including administrators), the injected JavaScript executes in their browser context. This is a stored XSS variant rather than reflected XSS because the payload persists in the WordPress database within post content.

Affected ProductsAI

Fleetwire Fleet Management WordPress plugin versions 1.0.19 and earlier are vulnerable. The plugin is distributed via the official WordPress plugin repository (wordpress.org/plugins/fleetwire-fleet-management). The vulnerability affects all installations of this plugin on WordPress sites regardless of WordPress version, as long as the plugin version is 1.0.19 or below and one or more users with contributor-level or higher access exist on the site.

RemediationAI

Update the Fleetwire Fleet Management plugin to version 1.0.20 or later, which includes fixes for input sanitization and output escaping on the fleetwire_list shortcode attributes. Site administrators should navigate to Plugins > Installed Plugins in the WordPress dashboard, locate Fleetwire Fleet Management, and click Update if available. Immediately after patching, audit all posts and pages using the fleetwire_list shortcode for suspicious or unexpected attribute values that may have been injected by compromised accounts. If an unpatched version is currently in use, temporarily disable the plugin or restrict contributor access until the update can be applied. Review WordPress user roles and audit which accounts have contributor-level permissions to minimize future attack surface.