CVE-2025-23523
Published: 14 February 2025
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hoststreamsell HSS Embed Streaming Video hss-embed-streaming-video allows Reflected XSS.This issue affects HSS Embed Streaming Video: from n/a through <= 3.23.
Security Summary
CVE-2025-23523 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS, CWE-79), in the hoststreamsell HSS Embed Streaming Video WordPress plugin (hss-embed-streaming-video). The issue affects all versions from n/a through 3.23 inclusive, with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
A remote attacker can exploit this vulnerability over the network with low attack complexity and no privileges required, though it necessitates user interaction such as visiting a maliciously crafted link or page. Exploitation changes the scope of impact, enabling limited effects on confidentiality, integrity, and availability, typically through execution of arbitrary JavaScript in the context of the victim's browser session.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/hss-embed-streaming-video/vulnerability/wordpress-hss-embed-streaming-video-plugin-3-23-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve) documents the Reflected XSS vulnerability in the HSS Embed Streaming Video WordPress plugin up to version 3.23.
Details
- CWE(s)