What is the CVSS score of EUVD-2025-28521?

EUVD-2025-28521 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

My Resume Builder EUVD-2025-28521

| CVE-2025-53336 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-06-27 audit@patchstack.com

WordPress XSS Wordpress Plugin

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Stored XSS requires contributor authentication and passive victim page view; availability impact is not applicable for typical stored XSS exploitation.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 00:16 euvd

EUVD-2025-28521

Analysis Generated

Mar 16, 2026 - 00:16 vuln.today

CVE Published

Jun 27, 2025 - 14:15 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in abditsori My Resume Builder allows Stored XSS. This issue affects My Resume Builder: from n/a through 1.0.3.

AnalysisAI

Stored XSS in the My Resume Builder WordPress plugin (versions through 1.0.3) enables authenticated contributors to inject persistent JavaScript payloads into resume content that executes in the browsers of other users who view it. When a privileged user such as an administrator views the affected page, the injected script runs in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit has been identified at time of analysis, and the EPSS score of 0.04% indicates negligible observed exploitation interest.

Technical ContextAI

My Resume Builder is a WordPress plugin by abditsori that allows site users to create and publish resume profiles. CWE-79 (Stored Cross-Site Scripting) results when user-supplied input submitted through plugin resume fields is persisted to the WordPress database without adequate sanitization and subsequently rendered in page output without context-appropriate HTML escaping. This allows injected script tags or event handlers to execute in any visitor's browser when the stored content is displayed. The CVSS scope-change metric (S:C) reflects the cross-boundary nature of the attack: a contributor-level user's malicious input executes within the browser security context of a higher-privileged viewer, such as a site administrator. Affected product: WordPress plugin my-resume-builder, versions n/a through 1.0.3.

RemediationAI

Consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/my-resume-builder/vulnerability/wordpress-my-resume-builder-plugin-1-0-3-cross-site-scripting-xss-vulnerability to confirm whether a patched release above 1.0.3 is available, and upgrade immediately if so. If no updated version is available in the WordPress plugin repository, deactivate and remove the plugin until a patch is released. As compensating controls, restrict contributor-level registration to trusted users only, or require administrator approval for all published resume content before it is rendered to other users. Deploying a WAF rule targeting common XSS patterns in form submissions can reduce exploitation likelihood but does not address the underlying code deficiency and should not substitute for a vendor patch.