What is the CVSS score of CVE-2025-62885?

CVE-2025-62885 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

PHP CVE-2025-62885

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-10-27 audit@patchstack.com

WordPress PHP XSS

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Oct 27, 2025 - 02:15 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RexTheme WP VR wpvr allows DOM-Based XSS.This issue affects WP VR: from n/a through <= 8.5.48.

AnalysisAI

DOM-based cross-site scripting (XSS) in RexTheme WP VR WordPress plugin up to version 8.5.48 allows authenticated users with low privileges to inject malicious scripts that execute in other users' browsers with site-wide scope. The vulnerability requires user interaction (UI:R) and affects confidentiality, integrity, and availability equally. Exploitation requires valid WordPress account credentials but carries moderate real-world risk given the low EPSS score (0.02%) and authenticated requirement despite the CVSS 6.5 rating.

Technical ContextAI

The vulnerability is a CWE-79 (Improper Neutralization of Input During Web Page Generation) manifesting as DOM-based XSS, meaning the malicious payload is injected into the JavaScript execution context of the client-side DOM rather than the server response. This occurs in the WP VR plugin, a WordPress extension that likely handles virtual reality or immersive content functionality. The attack vector is network-based with low complexity, exploiting insufficient input sanitization or output encoding in JavaScript handling within the plugin's frontend or admin interface. DOM-based XSS typically exploits insufficient validation of user-controlled data passed to dangerous JavaScript functions like innerHTML, eval(), or location manipulation.

Affected ProductsAI

RexTheme WP VR WordPress plugin versions from unspecified baseline through 8.5.48 inclusive. Per the Patchstack database reference, vulnerable versions include at minimum 8.5.42 and earlier iterations up to 8.5.48. Administrators running any version of this plugin at or below 8.5.48 on WordPress installations should be considered affected.

RemediationAI

Update the RexTheme WP VR plugin to a version newer than 8.5.48 via the WordPress plugin dashboard (Plugins > Installed Plugins > WP VR > Update Now) or directly from the plugin repository. The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wpvr/ indicates patched versions are available; consult that advisory for the specific fixed version number and installation guidance. As an interim measure on systems that cannot be immediately patched, restrict plugin access to trusted administrators only through WordPress user role management and consider disabling the plugin if not actively in use. Enable WordPress security monitoring to detect suspicious DOM-based XSS payloads in logs.