CVE-2025-23475

CVE-2025-23475 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the fireantology History Timeline WordPress plugin, known as history-timeline. This issue affects all versions from n/a through 0.7.2, as published on 2025-01-22.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Remote attackers with no required privileges can exploit it over the network with low attack complexity, though it requires user interaction, such as a victim visiting a crafted URL. Exploitation enables limited impacts on confidentiality, integrity, and availability across a changed scope, typically allowing script execution in the victim's browser to steal session cookies or perform other client-side actions.

Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/history-timeline/vulnerability/wordpress-history-timeline-plugin-0-7-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve documents the Reflected XSS vulnerability in the WordPress History Timeline plugin version 0.7.2. Practitioners should review this reference for recommended mitigations, such as applying available patches or implementing input sanitization.