CVE-2025-22751

CVE-2025-22751 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, affecting the farinspace Partners WordPress plugin. This issue impacts all versions from an unspecified initial release through 0.2.0, as published on 2025-01-15.

The vulnerability carries a CVSS v3.1 base score of 7.1 (High) with the vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. Remote attackers require no privileges and can exploit it over the network with low attack complexity, though user interaction is needed, such as clicking a malicious link. Exploitation enables reflected XSS, potentially allowing limited impacts on confidentiality, integrity, and availability, with a changed scope that could facilitate cross-origin actions like session hijacking or script injection in the victim's browser context.

Mitigation details are provided in advisories including the Patchstack database entry at https://patchstack.com/database/Wordpress/Plugin/partners/vulnerability/wordpress-partners-plugin-0-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.