CVE-2025-22576

CVE-2025-22576 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Site PIN WordPress plugin developed by Marcus Downing. This issue affects the Site PIN plugin from unknown initial versions through version 1.3 inclusive. The vulnerability was published on 2025-01-13 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

Attackers can exploit this vulnerability remotely over the network with low attack complexity and no required privileges, though it demands user interaction such as clicking a malicious link. Upon successful exploitation, adversaries achieve limited impacts on confidentiality, integrity, and availability with a changed scope, enabling actions like script injection in the victim's browser to potentially steal session cookies, redirect users, or perform other client-side attacks within the site's context.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/site-pin/vulnerability/wordpress-site-pin-plugin-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve details this Reflected XSS vulnerability in the WordPress Site PIN plugin up to version 1.3, serving as the primary reference for security practitioners to review specific mitigation guidance, such as applying available patches or hardening configurations.