CVE-2025-22594
Published: 09 January 2025
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hccoder Better User Shortcodes better-user-shortcodes allows Reflected XSS.This issue affects Better User Shortcodes: from n/a through <= 1.0.
Security Summary
CVE-2025-22594 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Better User Shortcodes WordPress plugin by hccoder. The issue affects the plugin from unspecified initial versions through version 1.0 inclusive. Published on January 9, 2025, it carries a CVSS v3.1 base score of 7.1.
Attackers can exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) but user interaction (UI:R), such as clicking a malicious link. Exploitation changes scope (S:C) and enables low impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), allowing arbitrary script execution in the victim's browser context.
Mitigation details are available in advisories like the Patchstack database entry at https://patchstack.com/database/Wordpress/Plugin/better-user-shortcodes/vulnerability/wordpress-better-user-shortcodes-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)