Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pjfc SyncFields syncfields allows Reflected XSS.This issue affects SyncFields: from n/a through <= 2.1.
Published: 2025-01-07
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a Reflected Cross‑Site Scripting flaw caused by improper neutralization of input in the SyncFields plugin for WordPress. This weakness, identified as CWE‑79, allows malicious JavaScript to be reflected in a page that is served to users when crafted input is incorporated into the HTML output. The flaw results solely from crafted input that is returned directly in the response.

Affected Systems

The affected product is the pjfc SyncFields WordPress plugin of any version up to and including 2.1. No earlier version constraint is specified; therefore any deployment using version 2.1 or an earlier release is vulnerable.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity. The EPSS score of <1% indicates a very low likelihood of exploitation at the time of analysis. The vulnerability is not listed in CISA KEV. The attack vector is inferred to be remote, requiring the attacker to supply crafted input (URL or form data) that triggers the reflected output.

Generated by OpenCVE AI on May 2, 2026 at 09:54 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the SyncFields plugin to the latest released version that is greater than 2.1.
  • If an upgrade is not immediately possible, remove or disable the SyncFields plugin until a patch is available.
  • Deploy a Web Application Firewall or similar filtering that blocks or sanitizes reflected script payloads to mitigate the risk while a remediation is applied.

Generated by OpenCVE AI on May 2, 2026 at 09:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-2757 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PJFC SyncFields allows Reflected XSS.This issue affects SyncFields: from n/a through 2.1.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PJFC SyncFields allows Reflected XSS.This issue affects SyncFields: from n/a through 2.1. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pjfc SyncFields syncfields allows Reflected XSS.This issue affects SyncFields: from n/a through <= 2.1.
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Tue, 07 Jan 2025 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 07 Jan 2025 11:00:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PJFC SyncFields allows Reflected XSS.This issue affects SyncFields: from n/a through 2.1.
Title WordPress SyncFields plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:11:00.152Z

Reserved: 2025-01-03T13:16:57.347Z

Link: CVE-2025-22359

cve-icon Vulnrichment

Updated: 2025-01-07T15:51:55.449Z

cve-icon NVD

Status : Deferred

Published: 2025-01-07T11:15:19.310

Modified: 2026-06-17T08:46:45.520

Link: CVE-2025-22359

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-02T10:00:06Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')