CVE-2025-22631
Published: 23 February 2025
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vbout Marketing Automation marketing-automation allows Reflected XSS.This issue affects Marketing Automation: from n/a through <= 1.2.6.8.
Security Summary
CVE-2025-22631 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, affecting the vbout Marketing Automation plugin for WordPress. The issue impacts Marketing Automation versions from n/a through 1.2.6.8 and was published on 2025-02-23.
The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating exploitation over the network with low attack complexity, no required privileges, and user interaction. A remote unauthenticated attacker can craft a malicious request, such as a link, and trick a victim into accessing it on a vulnerable site, leading to arbitrary script execution in the victim's browser context and potential low-level impacts on confidentiality, integrity, and availability with changed scope.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/marketing-automation/vulnerability/wordpress-marketing-automation-plugin-1-2-6-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)