What is the CVSS score of CVE-2025-62746?

CVE-2025-62746 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-62746

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-12-30 audit@patchstack.com

WordPress XSS

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

6.5 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 30, 2025 - 16:15 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeFlavors Featured Video for WordPress – VideographyWP videographywp allows Stored XSS.This issue affects Featured Video for WordPress – VideographyWP: from n/a through <= 1.0.18.

AnalysisAI

Stored cross-site scripting (XSS) in CodeFlavors Featured Video for WordPress (VideographyWP) plugin version 1.0.18 and earlier allows authenticated attackers to inject malicious scripts that execute in the browsers of other site users, potentially compromising administrator accounts and site integrity. The vulnerability stems from improper input sanitization during web page generation, and no public exploit code has been identified at the time of analysis.

Technical ContextAI

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a foundational cross-site scripting weakness. The VideographyWP plugin, which provides featured video functionality for WordPress sites, fails to properly sanitize or escape user-supplied input before rendering it in the DOM. This allows an attacker to inject arbitrary JavaScript code that persists in the database (stored XSS) and executes whenever the affected page or content is viewed by other users. WordPress plugins that handle media, metadata, or user-generated content are common targets for this class of vulnerability because they often process and display untrusted data without adequate output encoding.

Affected ProductsAI

CodeFlavors Featured Video for WordPress (VideographyWP plugin) versions 1.0.18 and all earlier versions are affected. The plugin is available on the WordPress.org plugin repository. Affected administrators should identify installations using this plugin via the WordPress admin dashboard or wp-cli command line tools.

RemediationAI

Update the VideographyWP plugin to the latest available version released after 1.0.18 via the WordPress admin dashboard (Plugins > Installed Plugins > Featured Video for WordPress - VideographyWP > Update) or directly from the WordPress.org plugin repository. If a patched version is not yet available, temporarily disable the plugin until an update is released. Site administrators should also audit published content created with the plugin for signs of injected scripts and review user account activity logs for unauthorized content modifications. Additional details are available in the Patchstack vulnerability database entry referenced below.