CVE-2025-23488

CVE-2025-23488 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Reflected Cross-site Scripting (XSS) as classified under CWE-79. It affects the rng-refresh WordPress plugin developed by Abolfazl Sabagh, impacting all versions from n/a through 1.0 inclusive. The issue was published on 2025-03-03T14:15:37.930 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

Attackers can exploit this vulnerability remotely over the network with low attack complexity and no required privileges, though it necessitates user interaction such as visiting a maliciously crafted webpage or clicking a link. Upon successful exploitation, adversaries can inject and execute arbitrary scripts in the victim's browser context within the scope of the affected site, potentially compromising low levels of confidentiality, integrity, and availability due to the changed scope.

The Patchstack advisory documents this Reflected XSS vulnerability specifically in the WordPress rng-refresh plugin version 1.0, providing further details at https://patchstack.com/database/Wordpress/Plugin/rng-refresh/vulnerability/wordpress-rng-refresh-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.