What is the CVSS score of CVE-2025-62748?

CVE-2025-62748 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-62748

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-12-31 audit@patchstack.com

WordPress XSS

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

6.5 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 31, 2025 - 12:16 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Genetech Products Web and WooCommerce Addons for WPBakery Builder vc-addons-by-bit14 allows DOM-Based XSS.This issue affects Web and WooCommerce Addons for WPBakery Builder: from n/a through <= 1.5.

AnalysisAI

DOM-based cross-site scripting (XSS) in Genetech Products Web and WooCommerce Addons for WPBakery Builder (vc-addons-by-bit14) plugin versions up to 1.5 allows unauthenticated attackers to inject malicious scripts that execute in the context of affected user sessions. The vulnerability stems from improper neutralization of user-supplied input during web page generation. EPSS scoring (0.01%, percentile 3%) indicates very low real-world exploitation probability despite the nature of the flaw, and no public exploit code or active exploitation has been confirmed.

Technical ContextAI

This is a DOM-based XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) in a WordPress plugin that extends WPBakery Page Builder with additional web and e-commerce components. DOM-based XSS occurs when client-side JavaScript directly uses unsanitized input from the DOM to modify the page, allowing attackers to craft malicious payloads that bypass server-side sanitization. The affected plugin (CPE: wordpress:plugin:vc-addons-by-bit14) is a third-party extension that integrates with WPBakery's page building framework. The vulnerability likely exists in JavaScript handlers that process user-controlled parameters without proper output encoding or content security policy enforcement.

Affected ProductsAI

Genetech Products Web and WooCommerce Addons for WPBakery Builder (WordPress plugin slug: vc-addons-by-bit14) versions through 1.5 are affected. This includes all releases from the plugin's inception through version 1.5 inclusive. The plugin is hosted in the WordPress.org plugin repository and integrates with WPBakery Page Builder (formerly Visual Composer) to provide additional page-building components for WordPress sites, including WooCommerce-specific functionality.

RemediationAI

Update the vc-addons-by-bit14 plugin to a version newer than 1.5 if available from the WordPress plugin repository, or disable and remove the plugin if no patched version is released. WordPress site administrators should access their WordPress dashboard (wp-admin), navigate to Plugins > Installed Plugins, locate 'Web and WooCommerce Addons for WPBakery Builder', and either update it or deactivate it pending availability of a patched release. Consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/vc-addons-by-bit14/vulnerability/wordpress-web-and-woocommerce-addons-for-wpbakery-builder-plugin-1-5-cross-site-scripting-xss-vulnerability) for confirmation of patch availability and any vendor guidance. As a temporary mitigation, limit plugin access to trusted users and ensure Content Security Policy headers are configured to restrict inline script execution.