What is the CVSS score of CVE-2025-6387?

CVE-2025-6387 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-6387

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-07-24 security@wordfence.com

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 18:38 vuln.today

CVE Published

Jul 24, 2025 - 10:15 nvd

MEDIUM 6.4

DescriptionCVE.org

The WP Get The Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in WP Get The Table WordPress plugin versions up to 1.5 allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts via the 'url' parameter due to insufficient input sanitization and output escaping. Injected scripts execute whenever any user accesses the affected pages, potentially compromising site visitors and enabling account hijacking, malware distribution, or data theft. No public exploit code or active exploitation has been confirmed at time of analysis, but the vulnerability requires only contributor-level access and has a moderate CVSS score of 6.4 reflecting limited technical complexity and network-based attack vector.

Technical ContextAI

WP Get The Table is a WordPress plugin that processes and displays table data. The vulnerability exists in the plugin's handling of the 'url' parameter, which fails to properly sanitize user input before storage in the WordPress database and fails to apply adequate output escaping when rendering the parameter in page content. This is a classic Stored XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) where untrusted user input is persisted server-side and later executed in the context of other users' browsers. The vulnerability affects all versions through 1.5 and likely stems from direct use of unsanitized $_POST or $_GET parameters without WordPress security functions like sanitize_text_field() or wp_kses_post() during input handling, and missing escaping functions like esc_url() or esc_attr() during output rendering.

Affected ProductsAI

WP Get The Table WordPress plugin versions up to and including 1.5 are affected. The plugin is available via the official WordPress Plugin Repository at https://wordpress.org/plugins/wp-get-the-table/. All installations using version 1.5 or earlier should be considered vulnerable. The vulnerability impacts any WordPress site where untrusted contributors have been granted contributor-level or higher permissions.

RemediationAI

Update WP Get The Table to a patched version released after vulnerability disclosure. Consult the official plugin repository at https://wordpress.org/plugins/wp-get-the-table/#developers and https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3333917%40wp-get-the-table&new=3333917%40wp-get-the-table for the latest available version. As an interim mitigation, restrict contributor-level access to only trusted users, and consider temporarily disabling the WP Get The Table plugin if version updates are unavailable. WordPress administrators should audit the plugin's settings and any pages or posts using the plugin's functionality to identify potential XSS payloads that may have already been injected.