{"id":"CVE-2025-59467","title":"A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation if an Administrator is tricked into visiting a crafted malicious page","summary":"A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation if an Administrator is tricked into visiting a crafted malicious page. \n\nThis plugin is disabled …","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-79"],"vendor":"ui","product":"argentina_afip_invoices","affected":["argentina_afip_invoices < 1.3.0"],"patched":["argentina_afip_invoices 1.3.0"],"published":"2026-01-05","updated":"2026-09-30","sourceUpdated":"2026-09-30T22:10:00.273","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-59467","references":[{"url":"https://community.ui.com/releases/Security-Advisory-Bulletin-057/6d3f2a51-22b8-47a1-9296-1e9dcd64e073","label":"support@hackerone.com"}],"tags":["nvd"],"epss":0.0025,"epssPercentile":0.14782,"ingestedAt":"2026-09-30T22:27:27.690Z","slug":"CVE-2025-59467","body":"## Overview\n\nA Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation if an Administrator is tricked into visiting a crafted malicious page. \n\nThis plugin is disabled by default.\n\n\nAffected Products:\nUCRM Argentina AFIP invoices Plugin (Version 1.2.0 and earlier)\n\n \n\nMitigation:\nUpdate UCRM Argentina AFIP invoices Plugin to Version 1.3.0 or later.\n\n## Affected\n\n- `argentina_afip_invoices < 1.3.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `argentina_afip_invoices 1.3.0`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}