CVE-2025-23591

CVE-2025-23591 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, affecting the blu Logistics WordPress plugin (also referenced as blulogistics1 blu-logistics). This issue impacts all versions of the plugin from n/a through 1.0.0 inclusive. The vulnerability was published on 2025-02-03.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no privileges required, but user interaction needed, with changed scope and low impacts to confidentiality, integrity, and availability. Remote attackers can exploit it by crafting malicious inputs that reflect back to users, such as via phishing links or manipulated requests, tricking authenticated users into executing scripts in their browsers within the site's context.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/blu-logistics/vulnerability/wordpress-blu-logistics-plugin-1-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.