CVE-2025-23461

CVE-2025-23461 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Social2Blog WordPress plugin developed by xkollsoftware. This issue affects Social2Blog versions from n/a through 0.2.990 inclusive.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no privileges required, and user interaction needed, with changed scope and low impacts on confidentiality, integrity, and availability. Remote attackers can exploit it by tricking authenticated users into interacting with malicious input, such as clicking a crafted link, to inject and execute arbitrary scripts in the victim's browser context.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/social2blog/vulnerability/wordpress-social2blog-plugin-0-2-990-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve documents this Reflected XSS vulnerability in the WordPress Social2Blog plugin version 0.2.990 and provides details on affected components for mitigation guidance.