What is the CVSS score of CVE-2025-62962?

CVE-2025-62962 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of CloudSearch are affected by CVE-2025-62962?

The CloudSearch WordPress plugin (versions ≤3.0.0) contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts into your website, where they persist and…

How to fix or mitigate CVE-2025-62962?

Within 24 hours, disable the CloudSearch plugin immediately and assess whether CloudSearch functionality is essential to business operations; if not required, deactivate and remove it. Within 7 days, either update to a patched version if one becomes available, or implement a Web Application Firewall rule to block script injection attempts in CloudSearch parameters; simultaneously audit your WordPress database for any existing malicious scripts. Within 30 days, migrate to an alternative search solution if CloudSearch is necessary, implement stricter WordPress admin access controls (limit admin users to necessary personnel only), and establish a log monitoring process to detect future XSS injection attempts.

CloudSearch CVE-2025-62962

HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-10-27 audit@patchstack.com

WordPress XSS CSRF Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Attacker needs no credentials (PR:N) but must trick an authenticated victim into interacting (UI:R); stored XSS executes across scope (S:C) with limited CIA impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 12:19 vuln.today

CVE Published

Oct 27, 2025 - 02:15 cve.org

HIGH 7.1

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in Andrea Landonio CloudSearch cloud-search allows Stored XSS.This issue affects CloudSearch: from n/a through <= 3.0.0.

AnalysisAI

Stored cross-site scripting via CSRF in the CloudSearch WordPress plugin (versions up to and including 3.0.0) by Andrea Landonio allows a remote attacker to trick an authenticated user into submitting a forged request that injects persistent malicious script. Because the injected payload is stored and served to other users, its execution crosses a security scope (S:C), amplifying impact beyond the tricked victim. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.02%, 5th percentile), indicating negligible near-term mass-exploitation pressure.

Technical ContextAI

The affected component is a WordPress plugin (cloud-search) that extends site search functionality. The root cause is CWE-352 (Cross-Site Request Forgery): a state-changing request handler lacks anti-CSRF protection such as WordPress nonce verification (wp_verify_nonce/check_admin_referer). The absence of that check lets an attacker forge a request on behalf of a logged-in user, and because the submitted value is persisted and later rendered without adequate output encoding/sanitization, the flaw chains into stored XSS. The plugin runs inside the PHP-based WordPress request lifecycle, so the injected script ultimately executes in the browser context of anyone who views the affected page (e.g., admin dashboard or public search output).

Affected ProductsAI

CloudSearch (WordPress plugin slug: cloud-search) by Andrea Landonio, all versions from an unspecified lower bound through and including 3.0.0 (from n/a through <= 3.0.0). No CPE string was provided in the input. The vulnerability is catalogued in the Patchstack database and referenced via NVD at https://patchstack.com/database/Wordpress/Plugin/cloud-search/vulnerability/wordpress-cloudsearch-plugin-3-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

RemediationAI

No vendor-released patch identified at time of analysis; no fixed version beyond 3.0.0 is stated in the available data, so upgrading is not yet a confirmed option. As compensating controls, consider deactivating and removing the CloudSearch plugin until a patched release is published (trade-off: loss of the plugin's search functionality), which is the most reliable mitigation for an unpatched CSRF/stored-XSS chain. Deploy a WordPress-aware WAF or virtual patch (e.g., Patchstack) to filter forged requests and script payloads, restrict administrative/editor access and enforce short session lifetimes to shrink the pool of exploitable authenticated victims, and instruct privileged users to avoid clicking untrusted links while logged in. Monitor the vendor and the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/cloud-search/vulnerability/wordpress-cloudsearch-plugin-3-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve) for a fixed version and apply it once released.