CVE-2025-23460

CVE-2025-23460 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the rhizomaticweb RWS Enquiry And Lead Follow-up WordPress plugin (rws-enquiry). This issue affects all versions from n/a through 1.0 inclusive. Published on 2025-03-26T15:15:53.830, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to network accessibility, low attack complexity, and scope change.

Unauthenticated attackers (PR:N) can exploit this vulnerability remotely (AV:N) with low complexity (AC:L) by tricking targeted users (UI:R) into interacting with maliciously crafted web requests, such as links containing reflected XSS payloads processed by the plugin. Successful exploitation enables arbitrary JavaScript execution in the victim's browser context within the same site (S:C), potentially resulting in low-level impacts to confidentiality (C:L), integrity (I:L), and availability (A:L), such as session hijacking or data theft.

Advisories and mitigation guidance are detailed in the Patchstack vulnerability database entry at https://patchstack.com/database/Wordpress/Plugin/rws-enquiry/vulnerability/wordpress-rws-enquiry-and-lead-follow-up-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.