CVE-2025-23522

CVE-2025-23522 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the HM Portfolio WordPress plugin developed by Matthew Haines-Young. This issue affects the hm-portfolio plugin in all versions from n/a through 1.1.1 inclusive. The vulnerability was published on 2025-01-24.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no privileges required, and user interaction needed, with a changed scope and low impacts to confidentiality, integrity, and availability. Remote attackers can exploit it by crafting malicious inputs that reflect back to users via the web page, enabling script execution in the victim's browser context.

Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/hm-portfolio/vulnerability/wordpress-hm-portfolio-plugin-1-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve documents the Reflected XSS vulnerability in the WordPress HM Portfolio plugin version 1.1.1, providing details relevant to mitigation for affected deployments.