CVE-2025-22357

CVE-2025-22357 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Reflected Cross-site Scripting (XSS) as classified under CWE-79. It affects the Target Notifications WordPress plugin by wpdever, impacting all versions from n/a through 1.1.1 inclusive. The issue was published on 2025-01-07.

With a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the vulnerability can be exploited by unauthenticated attackers over the network with low attack complexity. Exploitation requires user interaction, such as clicking a malicious link that triggers the reflected XSS payload. Successful attacks change scope, allowing limited impacts on confidentiality, integrity, and availability, such as script execution in the victim's browser to potentially steal session data or perform actions on the targeted site.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/target-notifications/vulnerability/wordpress-target-notifications-plugin-1-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve provides details on this vulnerability in the Target Notifications plugin.