CVE-2025-23590

CVE-2025-23590 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, affecting the Dezdy dezdy-mcommerce WordPress plugin. The issue impacts Dezdy versions from n/a through 1.0 and was published on 2025-02-03.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating it is exploitable over the network with low attack complexity, no required privileges, but necessitating user interaction. Remote attackers can craft malicious links or inputs that, when processed by the plugin during web page generation, inject and execute arbitrary scripts in a victim's browser, potentially leading to limited impacts on confidentiality, integrity, and availability within a changed scope, such as session hijacking or data exfiltration.

Advisories, including the Patchstack database entry at https://patchstack.com/database/Wordpress/Plugin/dezdy-mcommerce/vulnerability/wordpress-dezdy-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve, provide further details on the vulnerability in the context of the WordPress Dezdy plugin.