CVE-2025-22765

CVE-2025-22765 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Reflected Cross-site Scripting (XSS) as classified under CWE-79. It affects the WP Order By WordPress plugin developed by weiluri, with the issue present in all versions from n/a through 1.4.2 inclusive.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Remote attackers with no required privileges can exploit it over the network with low attack complexity by tricking users into performing required interactions, such as visiting a malicious URL. Exploitation reflects attacker-controlled input through the plugin during web page generation, achieving low impacts on confidentiality, integrity, and availability within a changed scope.

Patchstack advisories document the Reflected XSS vulnerability in WP Order By version 1.4.2, providing details on the issue in their vulnerability database.