CVE-2025-7050
BaseFortify
Publication date: 2025-08-05
Last updated on: 2025-08-05
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wp_cloud_plugins | google_drive_plugin | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-7050 is a Stored Cross-Site Scripting (XSS) vulnerability in the Use-your-Drive | Google Drive plugin for WordPress, specifically in the 'title' parameter of file metadata. Due to insufficient input sanitization and output escaping, attackers with file upload privileges (including unauthenticated users if file upload is allowed) can inject arbitrary JavaScript code into the file description field. This malicious script executes whenever a user accesses a page displaying the injected file, potentially compromising site security. The vulnerability was fixed in version 3.3.2 by properly sanitizing the input to prevent script injection. [1]
How can this vulnerability impact me? :
This vulnerability can allow attackers to inject and execute arbitrary JavaScript code on pages that display uploaded files, which can lead to unauthorized actions such as stealing user credentials, session hijacking, defacing the website, or spreading malware. Since the exploit can be performed by users with the lowest file upload privileges, including unauthenticated users if file upload is enabled publicly, it poses a significant security risk to website integrity and user data. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves checking if your WordPress site is running the vulnerable Google Drive plugin version (up to 3.3.1) and if file upload shortcodes are published on publicly accessible posts. You can inspect uploaded file metadata for suspicious scripts in the 'title' or description fields. For example, use WP-CLI commands to list plugin versions: `wp plugin list` and check for 'google-drive' plugin version. Additionally, you can search your database or site files for suspicious JavaScript code in file descriptions. There are no specific network commands provided for detection. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediately update the Google Drive plugin to version 3.3.2 or later, which contains the fix that sanitizes file description inputs to prevent XSS attacks. After updating, clear any aggressive caching configurations to avoid compatibility issues. Also, review file upload permissions to restrict who can upload files, minimizing risk from unauthorized users. [1]