CVE-2025-23437

CVE-2025-23437 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the nord_tramper ntp-header-images header-images-rotator WordPress plugin. This issue affects versions of ntp-header-images from n/a through 1.2 inclusive. The vulnerability was published on 2025-03-03T14:15:34.890 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

The vulnerability can be exploited by remote attackers requiring no privileges or authentication. Exploitation involves tricking a user into interacting with malicious input, such as visiting a crafted URL, which causes the plugin to reflect unsanitized input during web page generation. This executes arbitrary scripts in the victim's browser context, potentially leading to low impacts on confidentiality, integrity, and availability, with a changed scope due to the cross-origin effects.

Mitigation details are available in advisories such as the Patchstack database entry at https://patchstack.com/database/Wordpress/Plugin/header-images-rotator/vulnerability/wordpress-ntp-header-images-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve.