CVE-2025-23598

CVE-2025-23598 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Reflected Cross-site Scripting (XSS) as classified under CWE-79. It affects the Recip.ly WordPress plugin (also referenced as recip-ly), developed by craig.edmunds@gmail.com, across all versions from n/a through 1.1.8 inclusive.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility with low attack complexity, no required privileges, but necessitating user interaction. Remote attackers can exploit it by tricking authenticated or unauthenticated users—such as site visitors or administrators—into interacting with malicious input, like a crafted URL or form submission. Successful exploitation allows injection and execution of arbitrary JavaScript in the victim's browser context, with low impacts on confidentiality, integrity, and availability due to the changed scope.

Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/reciply/vulnerability/wordpress-recip-ly-plugin-1-1-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve documents the reflected XSS issue specifically in Recip.ly plugin version 1.1.8 for WordPress, providing details for security practitioners to assess and address exposure in affected environments.