PHP
CVE-2025-62971
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrestaProject Attesa Extra attesa-extra allows Stored XSS.This issue affects Attesa Extra: from n/a through <= 1.4.7.
AnalysisAI
Stored cross-site scripting (XSS) in CrestaProject Attesa Extra WordPress plugin versions 1.4.7 and earlier allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of other site visitors, potentially compromising session tokens, stealing sensitive data, or performing unauthorized actions. The vulnerability requires user interaction (clicking a malicious link) to trigger the payload, affects confidentiality, integrity, and availability, and carries a moderate CVSS score of 6.5 despite very low EPSS exploitation probability (0.02%, 7th percentile), suggesting limited real-world weaponization despite the vector permitting network-based attacks.
Technical ContextAI
The vulnerability stems from improper input validation and output encoding in the Attesa Extra plugin (CWE-79: Improper Neutralization of Input During Web Page Generation). The plugin fails to sanitize and escape user-supplied input before rendering it in generated web pages, allowing an authenticated attacker with low privileges (PR:L per CVSS vector) to store malicious JavaScript payloads in the application backend. When other users-including administrators-view pages containing the stored payload, the script executes in their browser context with their session privileges. The CVSS vector indicates the attack requires low complexity (AC:L), network accessibility (AV:N), requires authentication (PR:L), and user interaction (UI:R), meaning a victim must be tricked into visiting a page where the payload has been injected.
Affected ProductsAI
CrestaProject Attesa Extra WordPress plugin is affected in versions from an undefined baseline through version 1.4.7. The plugin is identified by WordPress plugin namespace and is hosted in the WordPress plugin repository. No specific CPE string was provided in the source data, but the vulnerability specifically targets the Attesa Extra plugin for WordPress, affecting any installation running version 1.4.7 or earlier. A patched version addressing this issue has been released (per the Patchstack report), and site administrators should verify their current plugin version against the fixed release.
RemediationAI
Update CrestaProject Attesa Extra to the patched version released after 1.4.7, available through the WordPress plugin repository or the vendor's official distribution channel. Site administrators should navigate to Plugins > Installed Plugins in their WordPress dashboard, locate Attesa Extra, and apply the available update immediately. If an update is not yet available at the time of this analysis, disable the plugin temporarily by deactivating it from the Plugins page and limiting plugin functionality until a patched version is released. Review the Patchstack vulnerability database entry (https://patchstack.com/database/Wordpress/Plugin/attesa-extra/vulnerability/wordpress-attesa-extra-plugin-1-4-5-cross-site-scripting-xss-vulnerability?_s_id=cve) for confirmation of the patched version number and additional remediation guidance. Consider restricting low-privilege user roles (contributors, subscribers) from posting or editing content if the plugin allows such permissions, reducing the attack surface until patching is complete.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today