CVE-2025-32504

Deeper analysis

CVE-2025-32504 is a reflected cross-site scripting vulnerability (CWE-79) in the Silvasoft boekhouden WordPress plugin. The flaw stems from improper neutralization of input during web page generation and affects all versions through 3.0.6. It carries a CVSS 3.1 score of 7.1 with network attack vector, low complexity, no required privileges, and required user interaction, plus a changed scope that permits limited impacts to confidentiality, integrity, and availability.

An unauthenticated attacker can craft a malicious URL containing injected script that is reflected back to a victim who clicks the link. Successful exploitation executes attacker-controlled JavaScript in the context of the vulnerable site, enabling actions such as session token theft, unauthorized actions on behalf of the user, or limited site manipulation.

The sole advisory reference is a Patchstack entry that identifies the reflected XSS issue in versions up to 3.0.6 but supplies no further mitigation details. The associated EPSS score remains flat at 0.0111 with no material increase after disclosure.