Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gerrygooner Rebuild Permalinks rebuild-permalinks allows Reflected XSS.This issue affects Rebuild Permalinks: from n/a through <= 1.6.
Published: 2025-04-17
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Rebuild Permalinks plugin contains an improper neutralization of input during web page generation that allows attacker-controlled input to be reflected and executed as script in the victim’s browser. When a user accesses a crafted link, the input is included in the response without proper escaping, enabling the injection of arbitrary client‑side scripts.

Affected Systems

All releases of the Rebuild Permalinks plugin from the earliest available version through 1.6 are affected. Any WordPress site that has this plugin installed and active is at risk.

Risk and Exploitability

The CVSS score of 7.1 marks this flaw as high severity. The EPSS score of less than 1% indicates a currently low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Because no authentication is required, the vulnerability can be triggered remotely via a malicious URL.

Generated by OpenCVE AI on May 2, 2026 at 11:06 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Rebuild Permalinks to a version that fixes the XSS vulnerability.
  • If an update is not immediately possible, deactivate or delete the plugin to eliminate the risk until a fix is available.
  • Verify that all WordPress plugins and themes are kept up to date to mitigate related vulnerabilities.

Generated by OpenCVE AI on May 2, 2026 at 11:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-11643 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gerrygooner Rebuild Permalinks allows Reflected XSS. This issue affects Rebuild Permalinks: from n/a through 1.6.
History

Wed, 29 Apr 2026 10:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gerrygooner Rebuild Permalinks allows Reflected XSS. This issue affects Rebuild Permalinks: from n/a through 1.6. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gerrygooner Rebuild Permalinks rebuild-permalinks allows Reflected XSS.This issue affects Rebuild Permalinks: from n/a through <= 1.6.
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Thu, 17 Apr 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 17 Apr 2025 16:00:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gerrygooner Rebuild Permalinks allows Reflected XSS. This issue affects Rebuild Permalinks: from n/a through 1.6.
Title WordPress Rebuild Permalinks Plugin <= 1.6 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-29T09:51:54.768Z

Reserved: 2025-02-21T16:46:02.627Z

Link: CVE-2025-27346

cve-icon Vulnrichment

Updated: 2025-04-17T17:45:08.200Z

cve-icon NVD

Status : Deferred

Published: 2025-04-17T16:15:38.293

Modified: 2026-04-29T10:16:43.870

Link: CVE-2025-27346

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-02T11:15:19Z

Weaknesses