Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awcode AWcode Toolkit awcode-toolkit allows Reflected XSS.This issue affects AWcode Toolkit: from n/a through <= 1.0.14.
Published: 2025-02-14
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a reflected XSS flaw caused by inadequate input neutralization in the AWcode Toolkit plugin. An attacker can craft a malicious URL that includes script payloads; when a user browses the URL, the script is executed within the victim’s browser. This allows the attacker to steal session cookies, deface the site, or perform other client‑side attacks. The weakness falls under CWE‑79, reflecting inadequate output encoding or sanitization.

Affected Systems

The flaw exists in the AWcode Toolkit WordPress plugin for all releases up to and including version 1.0.14. Version 1.0.15 and later contain the fix. The affected product is the AWcode Toolkit plugin for WordPress.

Risk and Exploitability

The CVSS score is 7.1, indicating a high severity. The EPSS score is less than 1 %, suggesting a low exploitation probability but not negligible. The vulnerability is not currently listed in the CISA KEV catalog. Based on the description, the likely attack vector is a user‑initiated request to a crafted URL on the website where the plugin is installed.

Generated by OpenCVE AI on May 1, 2026 at 16:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the AWcode Toolkit WordPress plugin to version 1.0.15 or later, which removes the reflected XSS bug.
  • If an immediate upgrade is not possible, sanitize all user‑supplied input before output, e.g., by using WordPress functions such as esc_html(), esc_attr(), or wp_kses() on data displayed by the plugin.
  • Deploy a web‑application firewall or other XSS filtering rule to detect and block malicious payloads in HTTP requests to the affected plugin endpoints.

Generated by OpenCVE AI on May 1, 2026 at 16:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-3762 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awcode AWcode Toolkit allows Reflected XSS. This issue affects AWcode Toolkit: from n/a through 1.0.14.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awcode AWcode Toolkit allows Reflected XSS. This issue affects AWcode Toolkit: from n/a through 1.0.14. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awcode AWcode Toolkit awcode-toolkit allows Reflected XSS.This issue affects AWcode Toolkit: from n/a through <= 1.0.14.
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Mon, 14 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00032}

 epss

{'score': 0.00035}

Sun, 13 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00072}

 epss

{'score': 0.00032}

Fri, 14 Feb 2025 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 14 Feb 2025 13:00:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awcode AWcode Toolkit allows Reflected XSS. This issue affects AWcode Toolkit: from n/a through 1.0.14.
Title WordPress AWcode Toolkit plugin <= 1.0.14 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-05-11T23:33:46.728Z

Reserved: 2025-01-23T14:50:25.793Z

Link: CVE-2025-24554

cve-icon Vulnrichment

Updated: 2025-02-14T15:48:30.727Z

cve-icon NVD

Status : Deferred

Published: 2025-02-14T13:15:48.113

Modified: 2026-06-17T08:59:13.187

Link: CVE-2025-24554

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-01T16:30:20Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')