CVE-2025-22324

CVE-2025-22324 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the OZ Canonical WordPress plugin developed by Andon Ivanov. This issue affects the plugin in all versions from n/a through 0.5 inclusive, with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

A remote attacker requires no privileges and can exploit the vulnerability over the network with low attack complexity, though user interaction is necessary, such as a victim visiting a crafted URL. Successful exploitation enables script execution in the victim's browser context, potentially compromising low levels of confidentiality, integrity, and availability while changing scope to affect additional resources.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/oz-canonical/vulnerability/wordpress-oz-canonical-plugin-0-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve details this Reflected XSS vulnerability in the WordPress OZ Canonical plugin version 0.5 and serves as the primary reference for mitigation steps.