CVE-2025-23451

CVE-2025-23451 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Awesome Twitter Feeds WordPress plugin by titodevera. This issue affects all versions of the plugin from n/a through 1.0 inclusive. Published on 2025-03-03, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

The vulnerability can be exploited by unauthenticated attackers accessible over the network, with low attack complexity but requiring user interaction, such as visiting a maliciously crafted URL. Exploitation changes the security scope and enables limited impacts on confidentiality, integrity, and availability, allowing attackers to inject and execute arbitrary scripts in victims' browsers, potentially leading to session hijacking, data theft, or other client-side compromises typical of reflected XSS.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/awesome-twitter-feeds/vulnerability/wordpress-awesome-twitter-feeds-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve provides details on this vulnerability in Awesome Twitter Feeds version 1.0. Security practitioners should review this reference for recommended mitigations, such as plugin updates or input sanitization workarounds.