CVE-2025-47611

WordPress User Meta plugin <= 3.1.2 - Reflected Cross Site Scripting (XSS) vulnerability

View on CVE.org
Published May 23, 2025 CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Khaled User Meta user-meta allows Reflected XSS.This issue affects User Meta: from n/a through <= 3.1.2.

Analysis

AI-generated

Technical impact

The User Meta plugin for WordPress contains an improper neutralization of input during page generation that allows attackers to inject malicious scripts into the browser of any user who visits a crafted URL. This flaw is a reflected XSS, classified as CWE‑79, and can lead to session hijacking, credential theft, or malicious content injection when users interact with the affected pages.

Affected Systems

The vulnerability affects the Khaled User Meta plugin, versions 3.1.2 and earlier. No other WordPress products are listed as affected.

Risk and Exploitability

The CVSS score of 7.1 indicates a moderate to high risk. However, the EPSS score of less than 1% suggests a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply a malicious URL containing unsanitized input to trigger the reflected XSS, which is straightforward but requires the victim to click a link or load a tainted page.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the User Meta plugin to the latest version (3.1.3 or newer).
  • If an upgrade is not immediately possible, remove the User Meta plugin from the WordPress installation to eliminate the vulnerability.
  • Configure a Content Security Policy that blocks inline script execution and disallows script injection from unknown sources.

Generated by OpenCVE AI on April 30, 2026 at 12:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-28101 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Khaled User Meta allows Reflected XSS. This issue affects User Meta: from n/a through 3.1.2.
History
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Khaled User Meta allows Reflected XSS. This issue affects User Meta: from n/a through 3.1.2. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Khaled User Meta user-meta allows Reflected XSS.This issue affects User Meta: from n/a through <= 3.1.2.
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Khaled User Meta allows Reflected XSS. This issue affects User Meta: from n/a through 3.1.2.
Title WordPress User Meta plugin <= 3.1.2 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

No data.

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:12 PM
Reserved
May 7, 2025, 10:44 AM

View source JSON

Updated
May 23, 2025, 3:22 PM

JSON

Status
Deferred
Published
May 23, 2025, 1:15 PM
Modified
Jun 17, 2026, 9:28 AM

View source JSON

No data.

Updated
Apr 30, 2026, 12:30 PM

JSON