CVE-2025-22353

CVE-2025-22353 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the bvads BVD Easy Gallery Manager WordPress plugin (bvd-easy-gallery-manager). This issue affects all versions of the plugin from n/a through 1.0.6 inclusive. The vulnerability was published on 2025-01-07.

With a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the flaw can be exploited remotely over the network by unauthenticated attackers with low attack complexity. Exploitation requires user interaction, such as visiting a maliciously crafted URL or page. Successful attacks enable limited impacts on confidentiality, integrity, and availability within a changed scope, potentially allowing attackers to execute arbitrary scripts in the victim's browser context.

Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/bvd-easy-gallery-manager/vulnerability/wordpress-bvd-easy-gallery-manager-plugin-1-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve documents the Reflected XSS vulnerability in BVD Easy Gallery Manager version 1.0.6.