CVE-2025-23586

CVE-2025-23586 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the WP Post Category Notifications WordPress plugin (wp-post-category-notifications, also identified as MAL73049). This issue affects all versions of the plugin from n/a through 1.0 inclusive. The vulnerability was published on 2025-03-03.

The vulnerability carries a CVSS v3.1 base score of 7.1 (High), with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. Remote attackers require no privileges and can exploit it over the network with low complexity, but it demands user interaction, such as clicking a malicious link. Successful exploitation changes the scope and enables limited impacts on confidentiality, integrity, and availability, typically allowing arbitrary JavaScript execution in the victim's browser to steal session data or perform other client-side actions within the site's context.

The primary advisory is available from Patchstack at https://patchstack.com/database/Wordpress/Plugin/wp-post-category-notifications/vulnerability/wordpress-wp-post-category-notifications-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve, which documents the Reflected XSS in version 1.0. Practitioners should review this reference for detailed analysis and any recommended mitigations, such as plugin updates or removal.