CVE-2025-23548

CVE-2025-23548 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Responsivity WordPress plugin developed by Bilal TAS. The issue affects all versions of the plugin from n/a through 0.0.6 inclusive.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no privileges required, and user interaction needed. Remote attackers can exploit it by tricking users into accessing crafted URLs or inputs that reflect malicious payloads in the web page, executing scripts in the victim's browser context and achieving low impacts to confidentiality, integrity, and availability with changed scope.

The primary advisory from Patchstack (https://patchstack.com/database/Wordpress/Plugin/responsivity/vulnerability/wordpress-responsivity-plugin-0-0-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve) documents the vulnerability in the WordPress Responsivity plugin version 0.0.6. Practitioners should review this reference for specific mitigation recommendations, such as applying available patches or updates to affected installations.