What is the CVSS score of CVE-2025-67912?

CVE-2025-67912 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

PHP CVE-2025-67912

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-12-16 audit@patchstack.com

WordPress PHP XSS

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 16, 2025 - 09:15 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premio Stars Testimonials stars-testimonials-with-slider-and-masonry-grid allows Stored XSS.This issue affects Stars Testimonials: from n/a through <= 3.3.4.

AnalysisAI

Stored cross-site scripting (XSS) in Premio Stars Testimonials WordPress plugin versions 3.3.4 and below allows authenticated users to inject malicious scripts that execute in the context of other users' browsers, potentially compromising site administrators or visitors. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), limiting immediate risk, but the stored nature means injected payloads persist and affect multiple users. No public exploit code or active KEV status is documented, though the 6.5 CVSS score reflects moderate severity when considering cross-site impact.

Technical ContextAI

The vulnerability stems from improper input validation and output encoding in the Stars Testimonials plugin's testimonial submission or management functionality (CWE-79: Improper Neutralization of Input During Web Page Generation). The plugin fails to sanitize user-supplied input before storing it in the database and rendering it on web pages, allowing attackers to embed arbitrary JavaScript code. This is a classic stored XSS flaw affecting WordPress plugins that process user-generated content without adequate escaping. The CPE context indicates this affects the WordPress plugin ecosystem specifically, where authenticated users (typically those with Contributor, Author, or Editor roles) can create or modify testimonial entries that may not be properly filtered before display to higher-privileged users or the public.

Affected ProductsAI

Premio Stars Testimonials plugin (stars-testimonials-with-slider-and-masonry-grid) for WordPress versions up to and including 3.3.4 are affected. The vulnerability was reported by Patchstack's security audit team against the specific plugin distribution. Patched versions beyond 3.3.4 are presumed safe, though the exact patched version number is not stated in the available advisory reference at patchstack.com/database/Wordpress/Plugin/stars-testimonials-with-slider-and-masonry-grid/.

RemediationAI

Users should immediately update the Stars Testimonials plugin to a version newer than 3.3.4, available from the WordPress plugin repository or the vendor's site linked via Patchstack. Site administrators should review the plugin's update changelog to identify the first version released after 3.3.4 that patches this XSS flaw. As a temporary workaround pending patching, restrict plugin access to trusted administrators only via WordPress user role management; additionally, configure web application firewalls or security plugins to filter suspicious script tags in form submissions. The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/stars-testimonials-with-slider-and-masonry-grid/vulnerability/wordpress-stars-testimonials-plugin-3-3-4-cross-site-scripting-xss-vulnerability) contains detailed patching guidance and may specify the exact fixed version.