CVE-2025-23538
Published: 03 March 2025
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sophia M Williams WP Contest wp-contest allows Reflected XSS.This issue affects WP Contest: from n/a through <= 1.0.0.
Security Summary
CVE-2025-23538 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the WP Contest WordPress plugin by Sophia M Williams. The issue affects the plugin from unknown initial versions through 1.0.0. Published on 2025-03-03, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Attackers can exploit this vulnerability remotely over the network with low complexity and no required privileges, though it necessitates user interaction such as clicking a malicious link. Upon successful exploitation, adversaries achieve reflected XSS, enabling limited impacts on confidentiality, integrity, and availability across a changed scope, potentially allowing theft of user session data or execution of scripts in the victim's browser context.
The Patchstack advisory provides details on this vulnerability in WP Contest version 1.0.0: https://patchstack.com/database/Wordpress/Plugin/wp-contest/vulnerability/wordpress-wp-contest-plugin-1-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)