CVE-2025-23452

CVE-2025-23452 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Reflected Cross-site Scripting (XSS) as classified under CWE-79. It affects the EditionGuard for WooCommerce – eBook Sales with DRM WordPress plugin (editionguard-for-woocommerce-ebook-sales-with-drm), impacting all versions from n/a through 3.4.2 inclusive. The issue was published on 2025-01-16T20:15:35.730 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

Attackers can exploit this vulnerability remotely over the network with low complexity and no required privileges, though it demands user interaction such as clicking a malicious link. Upon successful exploitation, the changed scope allows limited impacts on confidentiality, integrity, and availability, typically enabling execution of arbitrary scripts in the victim's browser context under the site's origin, potentially leading to session token theft or other client-side attacks.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/editionguard-for-woocommerce-ebook-sales-with-drm/vulnerability/wordpress-editionguard-for-woocommerce-plugin-3-4-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve provides details on this Reflected XSS issue in EditionGuard for WooCommerce plugin version 3.4.2, recommending mitigation through updates or other vendor guidance.