CVE-2025-23433

CVE-2025-23433 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Cross-site Scripting (CWE-79), that enables Reflected XSS in the jnwry vcOS WordPress plugin (vcos). Published on 2025-03-03, it affects vcOS versions from n/a through 1.4.0.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, and user interaction needed for exploitation. Unauthenticated attackers can deliver malicious payloads via reflected inputs, tricking victims into executing scripts in their browsers, potentially leading to limited impacts on confidentiality, integrity, and availability with a changed scope.

The primary advisory from Patchstack (https://patchstack.com/database/Wordpress/Plugin/vcos/vulnerability/wordpress-vcos-plugin-1-4-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve) documents the issue in the WordPress vcOS plugin version 1.4.0 and provides details for practitioners to assess mitigation, such as applying available updates or input validation workarounds.