CVE-2025-46478

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaloha Dropdown Content dropdown-content allows Stored XSS.This issue affects Dropdown Content: from n/a through <= 1.0.2.

Overview

State: PUBLISHED
Assigner (CNA): Patchstack
CVSS severity: HIGH
CVSS score: 7.1 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Effective score: 7.1 / 10 HIGH source: CNA overview
CWE(s): CWE-79
Reserved: 2025-04-24
Published: 2025-04-24 18:08 UTC
Last updated: 2026-04-28 18:12 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/46xxx/CVE-2025-46478.json
Linked Threat: CVE-2025-46478 — Dropdown Content <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2025-04-24 16:15:38 UTC
NVD last modified: 2026-06-17 09:26:29 UTC
NVD CVSS v3.1: 7.1 / 10 HIGH source: audit@patchstack.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Exploitability subscore: 2.8 / 10
Impact subscore: 3.7 / 10
EPSS score: 0.0027 (probability of exploitation in next 30 days)
EPSS percentile: 18.75% vs all CVEs — higher = more likely to be exploited, as of 2026-07-26

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2025-12024
Assigner: Patchstack
Published: Apr 24, 2025, 4:08:48 PM
Updated: Apr 28, 2026, 4:12:38 PM
EUVD base score (CVSS 3.1): 7.1 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EUVD-reported EPSS: 0.1900
Vendors: metaloha
Products: Dropdown Content (n/a ≤1.0.2)

Dropdown Content (0 ≤1.0.2)
Aliases: GHSA-h67r-9fcg-7r5x

ENISA description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaloha Dropdown Content dropdown-content allows Stored XSS.This issue affects Dropdown Content: from n/a through <= 1.0.2.

EUVD references (1)

https://patchstack.com/database/Wordpress/Plugin/dropdown-content/vulnerability/wordpress-dropdown-content-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve

Affected products (1)

Vendor	Product	Versions	Platforms
metaloha	Dropdown Content	`0` (affected)	—

Vendor references (1)

References embedded in the original CVE record by the assigning CNA.

https://patchstack.com/database/Wordpress/Plugin/dropdown-content/vulnerability/wordpress-dropdown-content-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve vdb-entry

MITRE references (1) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

https://patchstack.com/database/Wordpress/Plugin/dropdown-content/vulnerability/wordpress-dropdown-content-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve vdb-entry

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (1)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://patchstack.com/database/Wordpress/Plugin/dropdown-content/vulnerability/wordpress-dropdown-content-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve audit@patchstack.com

Indicators (2)

IOCs linked to the auto-promoted Threat row.

Type	Value	VirusTotal	Attached
domain	`xss.this`	no local data	2026-05-18 21:19 UTC
cve	`CVE-2025-46478`	no local data	2026-06-06 13:45 UTC

Remediations (13)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Wordfence remediation: Dropdown Content

Wordfence

No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.

2026-06-06 13:45 UTC
Unmasking CVE-2025-66478: The Silent Killer in Next.js Server Actions

web:www.penligent.ai

Immediate Mitigation : The Patch The primary fix is to upgrade Next.js immediately. Fixed Versions: v15.1.9+, v16.0.7+. Mechanism: These versions introduce a strict allow-list for serializable types and sanitize module references during the hydration phase, preventing the instantiation of arbitrary system modules. Secondary Defense: Runtime ...

2026-05-22 13:54 UTC
Oracle Critical Patch Update Advisory - October 2025

web:www.oracle.com

This Critical Patch Update contains 374 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at October 2025 Critical Patch Update: Executive Summary and Analysis.

2026-05-22 13:54 UTC
Security Advisory: CVE-2025-66478 · Issue #86873 · vercel/next.js

web:github.com

A critical vulnerability has been identified in the React Server Components (RSC) protocol. The issue is rated CVSS 10.0 and can allow remote code execution when processing attacker-controlled requests in unpatched environments. This vulnerability originates in the upstream React implementation ( CVE - 2025 -55182). This advisory ( CVE - 2025 -66478) tracks the downstream impact on Next.js ...

2026-05-22 03:23 UTC
Next.js RSC Security Issue Explained (CVE-2025-66478)

web:medium.com

Next.js RSC Security Issue Explained ( CVE - 2025 -66478) And How to Permanently Fix It Before Your Deployment Breaks Next.js builds began self-blocking deployments with a red security …

2026-05-22 03:23 UTC
Security Advisory: CVE-2025-66478 - Next.js

web:nextjs.org

A critical vulnerability ( CVE - 2025 -66478) has been identified in the React Server Components protocol. Users should upgrade to patched versions immediately.

2026-05-22 03:23 UTC
Multiple Critical Vulnerabilities Patched in Next.js and React Server ...

web:cyberpress.org

Beyond security, the broader Next.js 16.2 release cycle also delivers meaningful performance improvements and over 200 Turbopack bug fixes, making the upgrade path beneficial well beyond vulnerability remediation alone.

2026-05-22 03:23 UTC
Security Update Guide - Loading - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-05-22 03:23 UTC
CVE-2025-66478 Vulnerability: Analysis, Impact, Mitigation | Huntress

web:www.huntress.com

Learn what CVE - 2025 -66478 vulnerability is, how it spreads, and how to detect and remove it before it impacts your systems.

2026-05-22 03:23 UTC
Microsoft Rolls Out Mitigations for 'YellowKey' BitLocker ...

web:www.securityweek.com

Microsoft has announced mitigations for CVE -2026-45585, a BitLocker bypass triggered via FsTx in Windows Recovery.

2026-05-22 03:23 UTC
Nvd - Cve-2025-66478

web:nvd.nist.gov

An official website of the United States government Here's how you know

2026-05-22 03:23 UTC
Microsoft Releases Mitigation for Windows BitLocker Security Bypass 0 ...

web:cybersecuritynews.com

Microsoft has disclosed a critical zero-day vulnerability in Windows BitLocker, tracked as CVE -2026-45585, that allows threat actors with physical access to bypass full-disk encryption entirely, potentially exposing sensitive data within minutes.

2026-05-22 03:23 UTC
Fixing CVE-2025-66478 in Next.js: Universal Guide - DEV Community

web:dev.to

A universal fix for CVE - 2025 -66478 involves upgrading to patched Next.js versions or downgrading from affected canaries, followed by secret rotation. Vulnerability Overview CVE - 2025 -66478 is a critical RCE flaw in React Server Components (RSC) protocol used by Next.js App Router, stemming from upstream React CVE - 2025 -55182.

2026-05-22 03:23 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2025-46478.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-46478",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-24T19:55:00.647457Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-25T13:53:28.453Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "dropdown-content",
          "product": "Dropdown Content",
          "vendor": "metaloha",
          "versions": [
            {
              "lessThanOrEqual": "1.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Muhammad Yudha - DJ | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-04-01T16:39:48.614Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaloha Dropdown Content dropdown-content allows Stored XSS.<p>This issue affects Dropdown Content: from n/a through <= 1.0.2.</p>"
            }
          ],
          "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaloha Dropdown Content dropdown-content allows Stored XSS.This issue affects Dropdown Content: from n/a through <= 1.0.2."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "Stored XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-28T16:12:38.927Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/Wordpress/Plugin/dropdown-content/vulnerability/wordpress-dropdown-content-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve"
        }
      ],
      "title": "WordPress Dropdown Content plugin <= 1.0.2 - Cross Site Scripting (XSS) Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2025-46478",
    "datePublished": "2025-04-24T16:08:48.936Z",
    "dateReserved": "2025-04-24T14:22:47.048Z",
    "dateUpdated": "2026-04-28T16:12:38.927Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}