CVE-2025-22754
Published: 15 January 2025
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Berkman Klein Center Amber amberlink allows Reflected XSS.This issue affects Amber: from n/a through <= 1.4.4.
Security Summary
CVE-2025-22754 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Berkman Klein Center Amber amberlink WordPress plugin. This issue affects Amber versions from n/a through 1.4.4.
The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating exploitation over the network with low complexity, no required privileges, and user interaction. An unauthenticated remote attacker can deliver a malicious payload via a crafted request, tricking a victim into interacting with it, such as clicking a link, to execute arbitrary scripts in the browser context of the targeted user.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/amberlink/vulnerability/wordpress-amber-plugin-1-4-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve documents this reflected XSS vulnerability in the WordPress Amber plugin up to version 1.4.4 and provides details for mitigation.
Details
- CWE(s)