What is the CVSS score of CVE-2025-8071?

CVE-2025-8071 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-8071

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-07-24 security@wordfence.com

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 18:38 vuln.today

CVE Published

Jul 24, 2025 - 10:15 nvd

MEDIUM 6.4

DescriptionCVE.org

Mine CloudVod plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘audio’ parameter in all versions up to, and including, 2.1.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Mine CloudVod WordPress plugin versions up to 2.1.10 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript through the 'audio' parameter due to insufficient input sanitization and output escaping. When injected pages are accessed by other users, the malicious scripts execute in their browsers, potentially compromising site security and user data. No public exploit code or active exploitation has been confirmed at analysis time.

Technical ContextAI

The vulnerability exists in the audio player rendering functionality of the Mine CloudVod WordPress plugin, specifically in the render.php file at line 66 where the 'audio' parameter is processed. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a Stored XSS vulnerability where user-supplied input is reflected directly into HTML output without proper sanitization or escaping. WordPress plugins handling user-controlled parameters in shortcodes or AJAX handlers must sanitize input using functions like sanitize_text_field() and escape output using esc_attr(), esc_url(), or wp_kses_post() depending on context. The plugin fails to implement these security controls on the 'audio' parameter, allowing injection of malicious script tags or event handlers that persist in the WordPress database and execute whenever the page renders.

Affected ProductsAI

Mine CloudVod WordPress plugin (all versions up to and including 2.1.10). The vulnerability was introduced before version 2.1.10 and confirmed present in that release. Patch information indicates version 2.2.0 contains fixes, as evidenced by the WordPress plugin repository changeset reference comparing the two versions. The plugin is available at https://wordpress.org/plugins/mine-cloudvod/ and runs on all WordPress installations where this plugin is installed and activated.

RemediationAI

Update the Mine CloudVod plugin to version 2.2.0 or later, which includes patches addressing the insufficient input sanitization in the audio parameter handling. Site administrators should navigate to their WordPress plugin dashboard, locate Mine CloudVod, and click 'Update' to apply the patched version. As an interim workaround pending updates, restrict Contributor-level access to trusted users only and review user accounts to remove any unnecessary elevated privileges. Additionally, use WordPress security plugins to monitor for suspicious content in posts and pages. For detailed information and patch availability confirmation, consult the official plugin advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/5f3cd194-3fb8-4dd9-905e-051d5de68b66?source=cve and the WordPress plugin repository at https://wordpress.org/plugins/mine-cloudvod/.