Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Abolfazl Sabagh rng-refresh rng-refresh allows Reflected XSS.This issue affects rng-refresh: from n/a through <= 1.0.
Published: 2025-03-03
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The rng-refresh WordPress plugin contains an improper neutralization of input during web page generation, enabling attackers to inject malicious scripts into the reflected response.

Affected Systems

The flaw affects the rng‑refresh plugin distributed by Abolfazl Sabagh for WordPress sites, specifically all releases up to and including version 1.0. WordPress installations that have not upgraded beyond 1.0 are susceptible.

Risk and Exploitability

The CVSS base score of 7.1 indicates moderate to high severity. The EPSS score of less than 1% suggests a low probability of widespread exploitation at present, and the vulnerability is not currently listed in CISA's KEV catalog. An attacker can exploit the reflected XSS by sending malicious input that the plugin returns unfiltered, which requires a vulnerable instance and user interaction to trigger.

Generated by OpenCVE AI on May 2, 2026 at 04:02 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the rng-refresh plugin to a version newer than 1.0 (or remove the plugin if no update is available).
  • If an upgrade is not immediately possible, implement a web‑application firewall or content security policy that blocks inline scripts to mitigate the XSS effect.
  • Verify that WordPress core and other plugins are regularly updated and that no other reflected XSS paths exist in the theme.

Generated by OpenCVE AI on May 2, 2026 at 04:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-5732 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound rng-refresh allows Reflected XSS. This issue affects rng-refresh: from n/a through 1.0.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound rng-refresh allows Reflected XSS. This issue affects rng-refresh: from n/a through 1.0. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Abolfazl Sabagh rng-refresh rng-refresh allows Reflected XSS.This issue affects rng-refresh: from n/a through <= 1.0.
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Tue, 04 Mar 2025 03:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 03 Mar 2025 13:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound rng-refresh allows Reflected XSS. This issue affects rng-refresh: from n/a through 1.0.
Title WordPress rng-refresh plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:11:10.422Z

Reserved: 2025-01-16T11:25:20.560Z

Link: CVE-2025-23488

cve-icon Vulnrichment

Updated: 2025-03-03T20:21:15.406Z

cve-icon NVD

Status : Deferred

Published: 2025-03-03T14:15:37.930

Modified: 2026-04-23T15:23:49.137

Link: CVE-2025-23488

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-02T04:15:06Z

Weaknesses