Vulnerability DatabaseCVE-2025-46448

CVE-2025-46448:
WordPress vulnerability analysis and mitigation

Overview

A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the Document Management System WordPress plugin, affecting versions up to 1.24. The vulnerability, discovered by researcher Nguyen Xuan Chien, was assigned CVE-2025-46448 on April 24, 2025. The issue stems from improper neutralization of input during web page generation (Wiz, Patchstack).

Technical details

The vulnerability has been classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received varying CVSS scores. Patchstack has assigned it a CVSS v3.1 score of 7.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The vulnerability falls under the OWASP Top 10 category A1: Broken Access Control and can be exploited without authentication (NVD, Patchstack).

Impact

If successfully exploited, this vulnerability enables attackers to inject malicious scripts, including redirects and advertisements, into the affected website. These injected payloads would be executed when visitors access the site, potentially compromising user security and website integrity (Patchstack).

Mitigation and workarounds

As of April 30, 2025, no official fix is available for this vulnerability. However, Patchstack has issued a virtual patch to mitigate the issue by blocking potential attacks until an official fix becomes available. Website administrators are advised to implement these mitigations immediately (Patchstack).