CVE-2025-23516

CVE-2025-23516 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the brainvireinfo "Sale with Razorpay" WordPress plugin, also known as sell-with-razorpay. This issue affects all versions from n/a through 1.0 inclusive. The vulnerability was published on 2025-03-03 and carries a CVSS v3.1 base score of 7.1.

Attackers can exploit this Reflected XSS over the network (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) but user interaction (UI:R), resulting in a changed scope (S:C) with low impacts on confidentiality, integrity, and availability (C:L/I:L/A:L). A remote unauthenticated attacker could trick a user into visiting a maliciously crafted URL on a vulnerable site, leading to execution of arbitrary JavaScript in the victim's browser context.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/sell-with-razorpay/vulnerability/wordpress-sale-with-razorpay-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve provides details on this vulnerability in the WordPress Sale with Razorpay plugin version 1.0.