CVE-2025-22764

CVE-2025-22764 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, affecting the WP Post Corrector WordPress plugin developed by vipul Jariwala. This issue impacts all versions of the plugin from unknown initial release through 1.0.2.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), meaning it is exploitable remotely over the network with low attack complexity, requiring no privileges but user interaction such as clicking a malicious link. Attackers can deliver crafted payloads that are reflected unsanitized in web page responses, enabling arbitrary JavaScript execution in the context of the targeted user's browser and achieving low impacts on confidentiality, integrity, and availability with a changed scope.

Patchstack has documented this vulnerability in its database for the WP Post Corrector plugin version 1.0.2, providing details on the Reflected XSS issue; security practitioners should review the advisory at https://patchstack.com/database/Wordpress/Plugin/wp-post-corrector/vulnerability/wordpress-wp-post-corrector-plugin-1-0-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve for recommended mitigations.