CVE-2025-22776

CVE-2025-22776 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the WP Bulletin Board plugin (wp-bulletin-board) for WordPress developed by codebycarter. This issue affects all versions of the plugin from n/a through 1.1.4.

Attackers with network access can exploit this vulnerability without authentication or privileges, requiring low attack complexity and user interaction, such as visiting a malicious link. Exploitation enables script execution in the victim's browser context with a changed scope, resulting in low impacts to confidentiality, integrity, and availability, as reflected in the CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

The Patchstack advisory documents this Reflected XSS vulnerability specifically in WP Bulletin Board version 1.1.4 and provides further details on the issue.