Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Picture-Planet GmbH Verowa Connect verowa-connect allows Reflected XSS.This issue affects Verowa Connect: from n/a through <= 3.0.4.
Published: 2025-04-17
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability occurs due to improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts that are reflected back to the user. This can lead to session hijacking, credential theft, or defacement of the site. The weakness belongs to the input validation class, CWE‑79.

Affected Systems

The flaw affects the Verowa Connect plugin for WordPress released by Picture‑Planet GmbH. All installed copies with version numbers n/a through 3.0.4 are vulnerable. Administrators should review the versions deployed in their sites.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity. The EPSS score is below 1%, implying low exploitation probability according to current data. It is not part of the CISA KEV catalog. The likely attack vector is user interaction with a malicious URL or form that includes the forged script, which is then rendered by the victim’s browser.

Generated by OpenCVE AI on April 30, 2026 at 21:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Verowa Connect to version 3.0.5 or later, which corrects the input sanitization flaw.
  • If an immediate upgrade is not possible, restrict or sanitize the query parameters used by the plugin (e.g., remove the "user" or "msg" parameters) to prevent script injection.
  • Deploy a web application firewall rule that blocks or escapes suspicious script payloads in incoming requests to the affected plugin.

Generated by OpenCVE AI on April 30, 2026 at 21:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-11703 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Picture-Planet GmbH Verowa Connect allows Reflected XSS. This issue affects Verowa Connect: from n/a through 3.0.4.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Picture-Planet GmbH Verowa Connect allows Reflected XSS. This issue affects Verowa Connect: from n/a through 3.0.4. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Picture-Planet GmbH Verowa Connect verowa-connect allows Reflected XSS.This issue affects Verowa Connect: from n/a through <= 3.0.4.
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Thu, 17 Apr 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 17 Apr 2025 16:00:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Picture-Planet GmbH Verowa Connect allows Reflected XSS. This issue affects Verowa Connect: from n/a through 3.0.4.
Title WordPress Verowa Connect Plugin <= 3.0.4 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:12:25.284Z

Reserved: 2025-04-09T11:20:35.408Z

Link: CVE-2025-32609

cve-icon Vulnrichment

Updated: 2025-04-17T18:07:37.732Z

cve-icon NVD

Status : Deferred

Published: 2025-04-17T16:15:46.530

Modified: 2026-04-23T15:29:12.257

Link: CVE-2025-32609

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-30T22:00:08Z

Weaknesses