What is the CVSS score of CVE-2025-62900?

CVE-2025-62900 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Popular Posts by Webline CVE-2025-62900

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-10-27 audit@patchstack.com

WordPress XSS Wordpress Plugin

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.5 MEDIUM

Stored XSS requires low-privilege authenticated attacker, victim user interaction, and scope change; impacts confidentiality, integrity, and availability at a low level.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 18:27 vuln.today

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WeblineIndia Popular Posts by Webline popular-posts-by-webline allows Stored XSS.This issue affects Popular Posts by Webline: from n/a through <= 1.1.1.

AnalysisAI

Stored cross-site scripting in the Popular Posts by Webline WordPress plugin allows authenticated attackers to inject arbitrary web scripts into pages that will execute whenever a user accesses an affected page. The vulnerability affects plugin versions up to and including 1.1.1 and can lead to data theft or session hijacking when an administrator or other high-privilege user views the injected content. No active exploitation or public exploit code was identified at the time of analysis, and EPSS indicates a very low probability of widespread exploitation.

Technical ContextAI

The vulnerability is a classic stored cross-site scripting (XSS) issue (CWE-79) arising from improper neutralization of user-supplied input before it is rendered in web pages. In the context of the Popular Posts by Webline plugin for WordPress, user-controllable data-likely from post content or widget settings-is stored without sufficient sanitization and later included in the output without escaping, allowing JavaScript payloads to execute in the browser of anyone viewing the page. The plugin's CPE string is not explicitly provided, but given it is a WordPress plugin, the affected component is written in PHP and interacts with the WordPress database, making the stored payload persistent.

Affected ProductsAI

The WordPress plugin 'Popular Posts by Webline' from WeblineIndia is affected in all versions up to and including 1.1.1. No CPE string is available in the provided data. Further details can be found in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/popular-posts-by-webline/vulnerability/wordpress-popular-posts-by-webline-plugin-1-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve.

RemediationAI

No vendor-released patch has been identified at the time of this analysis. Until a fixed version is released, consider disabling the plugin if it is not essential. If the plugin must remain active, restrict content creation privileges to trusted users only and ensure that other security mechanisms (e.g., Content Security Policy headers) are in place to mitigate XSS payload execution, though these are not a substitute for proper input sanitization. Monitor the Patchstack reference or the WordPress plugin repository for updates.