CVE-2025-23588

CVE-2025-23588 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the WOW Best CSS Compiler WordPress plugin (best-css-compiler) developed by baonguyenyam. This issue affects all versions of the plugin from n/a through 2.0.2 inclusive. The vulnerability was published on 2025-02-03.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), meaning unauthenticated remote attackers can exploit it over the network with low complexity, though it requires user interaction such as clicking a malicious link. Successful exploitation allows attackers to inject and execute arbitrary scripts in the context of the victim's browser, potentially compromising user sessions or sensitive data visible to the affected page.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/best-css-compiler/vulnerability/wordpress-wow-best-css-compiler-plugin-2-0-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve provides details on this WordPress plugin vulnerability, including recommended mitigations such as updating to a patched version beyond 2.0.2.