CVE-2025-27016

WordPress Drivr Lite – Google Drive Plugin plugin <= 1.0.1 - Stored Cross Site Scripting (XSS) vulnerability

View on CVE.org
Published Feb 18, 2025 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awsm.in Drivr Lite – Google Drive Plugin allows Stored XSS. This issue affects Drivr Lite – Google Drive Plugin: from n/a through 1.0.1.

Analysis

AI-generated

Technical impact

A stored cross‑site scripting (XSS) flaw exists in the Drivr Lite – Google Drive Plugin for WordPress, allowing attackers to embed malicious script via user‑controlled input that is later rendered in the site’s HTML. The vulnerability is categorized as CWE‑79. Because the payload is stored, it can affect any visitor who views the content, potentially leading to session hijacking, credential theft, or defacement.

Affected Systems

The issue impacts the awsm.in Drivr Lite – Google Drive Plugin, affecting all releases up to and including version 1.0.1. No specific sub‑versions are listed, so any installation of the plugin within this range is susceptible.

Risk and Exploitability

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to inject script into the plugin’s data store, likely via the file picker or metadata interface, and then entice site visitors to interact with the stored content for the XSS to execute.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Drivr Lite – Google Drive Plugin to a version newer than 1.0.1, if available.
  • If no newer version exists, disable any plugin features that accept unsanitized input or remove the plugin entirely from the site.
  • Ensuring all user‑supplied data is properly escaped or filtered before rendering eliminates the XSS vector, addressing the CWE‑79 weakness.

Generated by OpenCVE AI on May 1, 2026 at 16:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-4775 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awsm.in Drivr Lite – Google Drive Plugin allows Stored XSS. This issue affects Drivr Lite – Google Drive Plugin: from n/a through 1.0.1.
History
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awsm.in Drivr Lite – Google Drive Plugin drivr-google-drive-file-picker allows Stored XSS.This issue affects Drivr Lite – Google Drive Plugin: from n/a through <= 1.0.1. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awsm.in Drivr Lite – Google Drive Plugin allows Stored XSS. This issue affects Drivr Lite – Google Drive Plugin: from n/a through 1.0.1.
References
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awsm.in Drivr Lite – Google Drive Plugin allows Stored XSS. This issue affects Drivr Lite – Google Drive Plugin: from n/a through 1.0.1. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awsm.in Drivr Lite – Google Drive Plugin drivr-google-drive-file-picker allows Stored XSS.This issue affects Drivr Lite – Google Drive Plugin: from n/a through <= 1.0.1.
References
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awsm.in Drivr Lite – Google Drive Plugin allows Stored XSS. This issue affects Drivr Lite – Google Drive Plugin: from n/a through 1.0.1.
Title WordPress Drivr Lite – Google Drive Plugin plugin <= 1.0.1 - Stored Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Earlier changes (1)

Subscriptions

No data.

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:11 PM
Reserved
Feb 17, 2025, 11:52 AM

View source JSON

Updated
Feb 18, 2025, 8:16 PM

JSON

Status
Deferred
Published
Feb 18, 2025, 8:15 PM
Modified
Jun 17, 2026, 9:02 AM

View source JSON

No data.

Updated
May 1, 2026, 4:15 PM

JSON