CVE-2025-22313
Published: 09 January 2025
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Widgetize Pages Light widgetize-pages-light allows Reflected XSS.This issue affects Widgetize Pages Light: from n/a through <= 3.0.
Security Summary
CVE-2025-22313 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the OTWthemes Widgetize Pages Light WordPress plugin (widgetize-pages-light). This issue affects all versions of the plugin from n/a through 3.0 inclusive. The vulnerability was published on 2025-01-09 and carries a CVSS v3.1 base score of 7.1.
Unauthenticated attackers (PR:N) can exploit this vulnerability remotely over the network (AV:N) with low attack complexity (AC:L), though it requires user interaction (UI:R). Successful exploitation enables reflected XSS, allowing attackers to inject and execute malicious scripts in the context of a victim's browser, resulting in low impacts to confidentiality, integrity, and availability (C:L/I:L/A:L) but with a changed scope (S:C).
Mitigation details are available in advisories such as the Patchstack database entry at https://patchstack.com/database/Wordpress/Plugin/widgetize-pages-light/vulnerability/wordpress-widgetize-pages-light-plugin-3-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)