CVE-2025-47625

WordPress DoFollow Case by Case plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerability

View on CVE.org
Published May 7, 2025 CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in apasionados DoFollow Case by Case dofollow-case-by-case allows Stored XSS.This issue affects DoFollow Case by Case: from n/a through <= 3.5.1.

Analysis

AI-generated

Technical impact

Improper neutralization of user input in the DoFollow Case by Case WordPress plugin allows an attacker to store malicious JavaScript that is later rendered as part of a web page. This stored XSS can lead to session hijacking, credential theft, or defacement of pages viewed by other users. The vulnerability is an example of CWE‑79, where input is not sanitized before output.

Affected Systems

The vulnerability affects the WordPress plugin DoFollow Case by Case, authored by "apasionados:DoFollow Case by Case," in all versions from n/a through which are 3.5.1. Any site running the plugin at version 3.5.1 or earlier is potentially compromised.

Risk and Exploitability

The CVSS score of 5.9 indicates a medium severity. The EPSS score is reported as less than 1%, suggesting a low likelihood of widespread exploitation at present. The vulnerability is not currently listed in the CISA KEV catalog. An attacker must have the ability to submit data via the plugin’s input fields, which is typically available to authorized site administrators or content editors, to inject malicious payloads that are stored and served to other visitors.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade DoFollow Case by Case to the latest version that addresses the XSS flaw or uninstall the plugin if it is no longer required.
  • If an upgrade is not immediately possible, deactivate the plugin or restrict its use to trusted administrators only to prevent the storage of malicious content.
  • Add a sanitization step or web‑application firewall rule that removes or encodes script tags from any input submitted through the plugin’s form fields.

Generated by OpenCVE AI on April 30, 2026 at 13:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-13758 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in apasionados DoFollow Case by Case allows Stored XSS. This issue affects DoFollow Case by Case: from n/a through 3.5.1.
History
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N'}

 cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in apasionados DoFollow Case by Case allows Stored XSS. This issue affects DoFollow Case by Case: from n/a through 3.5.1. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in apasionados DoFollow Case by Case dofollow-case-by-case allows Stored XSS.This issue affects DoFollow Case by Case: from n/a through <= 3.5.1.
Title WordPress DoFollow Case by Case <= 3.5.1 - Cross Site Scripting (XSS) Vulnerability WordPress DoFollow Case by Case plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerability
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L'}

 cvssV3_1

{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N'}
Type Values Removed Values Added
Metrics epss

{'score': 0.00031}

 epss

{'score': 0.00036}
Type Values Removed Values Added
First Time appeared Apasionados
Apasionados dofollow Case By Case
CPEs cpe:2.3:a:apasionados:dofollow_case_by_case:*:*:*:*:*:wordpress:*:*
Vendors & Products Apasionados
Apasionados dofollow Case By Case
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in apasionados DoFollow Case by Case allows Stored XSS. This issue affects DoFollow Case by Case: from n/a through 3.5.1.
Title WordPress DoFollow Case by Case <= 3.5.1 - Cross Site Scripting (XSS) Vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L'}
Earlier changes (1)
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:12 PM
Reserved
May 7, 2025, 10:44 AM

View source JSON

Updated
May 8, 2025, 3:22 PM

JSON

Status
Modified
Published
May 7, 2025, 3:16 PM
Modified
Jun 17, 2026, 9:28 AM

View source JSON

No data.

Updated
Apr 30, 2026, 1:30 PM

JSON