What is the CVSS score of EUVD-2026-15619?

EUVD-2026-15619 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Naturalife Extensions are affected by EUVD-2026-15619?

CVE-2026-25018 presents moderate security risk, a cross-site scripting vulnerability rated CVSS 7.1.

How to fix or mitigate EUVD-2026-15619?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Verify anti-CSRF tokens and content security policies are enforced.

Naturalife Extensions EUVD-2026-15619

| CVE-2026-25018 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-25 Patchstack

GHSA-2rx9-c484-mx43

XSS Naturalife Extensions

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15619

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stmcan NaturaLife Extensions naturalife-extensions allows Reflected XSS.This issue affects NaturaLife Extensions: from n/a through <= 2.1.

AnalysisAI

A Reflected Cross-Site Scripting (XSS) vulnerability exists in the stmcan NaturaLife Extensions WordPress plugin through version 2.1, allowing attackers to inject malicious scripts that execute in users' browsers when they visit crafted URLs. The vulnerability stems from improper input neutralization during web page generation (CWE-79), enabling attackers to steal session cookies, perform actions on behalf of users, or redirect users to malicious sites. No CVSS score, EPSS data, or KEV status have been published for this CVE, but the Patchstack report indicates active awareness in the security community.

Technical ContextAI

The vulnerability is a classic Reflected XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) in a WordPress plugin. The affected product is stmcan NaturaLife Extensions (CPE: cpe:2.3:a:stmcan:naturalife_extensions:*:*:*:*:*:*:*:*), which likely processes user-supplied input from URL parameters or form submissions without proper HTML encoding or sanitization before rendering it in HTTP responses. WordPress plugins are server-side PHP applications that interact directly with the WordPress core and database, making XSS flaws in such plugins a significant attack surface. Reflected XSS occurs when untrusted input is immediately echoed back to the client without encoding, allowing attackers to craft malicious URLs that execute arbitrary JavaScript in the victim's browser within the security context of the vulnerable website.

RemediationAI

Update the stmcan NaturaLife Extensions plugin to the latest available version beyond 2.1 as soon as a patched release is available. Site administrators should verify patch availability through the official WordPress plugin repository or contact the vendor directly for a security update timeline. As an immediate workaround before patching, administrators can disable the NaturaLife Extensions plugin entirely if not critical to operations, or implement Web Application Firewall (WAF) rules to detect and block common XSS payloads in URL parameters. Additionally, enforce Content Security Policy (CSP) headers with script-src restrictions and ensure all user input handling in the plugin is properly HTML-encoded before output. For users unable to patch immediately, review access logs for evidence of XSS exploitation attempts and consider restricting plugin functionality to authenticated administrators only via WordPress capabilities filtering.