CVE-2025-22539

CVE-2025-22539 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-Site Scripting (XSS) under CWE-79, affecting the ka2 Custom DataBase Tables WordPress plugin (custom-database-tables). This issue impacts all versions from n/a through 2.1.34. The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to network accessibility, low attack complexity, no required privileges, user interaction, and changed scope with low impacts on confidentiality, integrity, and availability.

Attackers can exploit this Reflected XSS vulnerability remotely over the network without authentication by tricking authenticated users into interacting with maliciously crafted links or inputs that reflect executable scripts on the affected WordPress site. Successful exploitation allows attackers to execute arbitrary scripts in the victim's browser context, potentially leading to session hijacking, theft of sensitive data such as cookies or credentials, or further site compromise within the browser's scope, though impacts remain low per the CVSS metrics.

The Patchstack advisory at the provided reference details the vulnerability in the Custom DataBase Tables plugin version 2.1.34 and recommends updating to a patched version beyond 2.1.34 to mitigate the issue, as no workaround is specified in the available information.