CVE-2025-23536

CVE-2025-23536 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Track Page Scroll WordPress plugin by mndpsingh287. The issue affects all versions of the track-page-scroll plugin from n/a through 1.0.2 inclusive.

With a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the vulnerability is exploitable over the network with low attack complexity and no required privileges, though it demands user interaction. Remote attackers can deliver malicious payloads via reflected inputs, enabling arbitrary JavaScript execution in the victim's browser context with a changed security scope, resulting in low impacts to confidentiality, integrity, and availability.

Patchstack documents this Reflected XSS vulnerability specific to the WordPress Track Page Scroll plugin up to version 1.0.2. For mitigation details, refer to the advisory at https://patchstack.com/database/Wordpress/Plugin/track-page-scroll/vulnerability/wordpress-track-page-scroll-plugin-1-0-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.