What is the CVSS score of CVE-2025-66094?

CVE-2025-66094 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-66094

Q: Which versions of Wordpress Plugin are affected by CVE-2025-66094?

Stored cross-site scripting (XSS) in Yada Wiki WordPress plugin through version 3.5 allows authenticated users to inject malicious scripts that execute in the browsers of other site visitors.

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-12-30 audit@patchstack.com

WordPress XSS Wordpress Plugin

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

6.5 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 30, 2025 - 17:15 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dmccan Yada Wiki yada-wiki allows Stored XSS.This issue affects Yada Wiki: from n/a through <= 3.5.

AnalysisAI

Stored cross-site scripting (XSS) in Yada Wiki WordPress plugin through version 3.5 allows authenticated users to inject malicious scripts that execute in the browsers of other site visitors. The vulnerability stems from improper input sanitization during web page generation, enabling persistent XSS attacks that could compromise site integrity, steal credentials, or perform actions on behalf of administrators. EPSS exploitation probability is very low at 0.04%, but the stored nature of the vulnerability means injected payloads persist across sessions.

Technical ContextAI

Yada Wiki is a WordPress plugin (CPE: wp:yada-wiki) that provides wiki functionality within WordPress sites. The vulnerability represents a CWE-79 Improper Neutralization of Input During Web Page Generation defect, which occurs when user-supplied data is rendered into HTML output without proper escaping or validation. In this case, the plugin fails to adequately sanitize or escape user inputs before storing them in the database and subsequently rendering them in web pages, allowing attackers to inject arbitrary HTML and JavaScript that will execute in the context of other users' browsers.

Affected ProductsAI

Yada Wiki (dmccan) WordPress plugin versions up to and including 3.5. The plugin is distributed through the WordPress plugin repository. The vulnerability affects all installations of Yada Wiki through version 3.5; no explicit lower version bound was defined in the advisory, suggesting all versions up to 3.5 are potentially vulnerable.

RemediationAI

Update Yada Wiki plugin to a patched version newer than 3.5 immediately. Access the WordPress admin dashboard, navigate to Plugins, and use the built-in update functionality to upgrade to the latest available version. If an automatic update is not offered, check the official Yada Wiki plugin page on wordpress.org or the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/yada-wiki/vulnerability/wordpress-yada-wiki-plugin-3-5-cross-site-scripting-xss-vulnerability for the specific patched release version. As a temporary mitigation pending patching, disable the Yada Wiki plugin if not actively required and restrict wiki page editing to highly trusted users only.