CVE-2025-23520

CVE-2025-23520 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the SecureSubmit Heartland Management Terminal WordPress plugin. This issue affects all versions from n/a through 1.3.0. The vulnerability was published on 2025-03-03.

The CVSS v3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, and user interaction needed, with changed scope and low impacts to confidentiality, integrity, and availability. Remote attackers can exploit it by tricking authenticated users into interacting with maliciously crafted links or inputs reflected in web pages, potentially leading to session hijacking, data theft, or site defacement within the plugin's context.

Patchstack provides details on the vulnerability in its advisory at https://patchstack.com/database/wordpress/plugin/heartland-management-terminal/vulnerability/wordpress-heartland-management-terminal-plugin-1-3-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve, which security practitioners should consult for mitigation guidance.