CVE-2025-23609

CVE-2025-23609 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Helle1 Tagesteller (tagesteller) WordPress plugin. This issue affects Tagesteller versions from n/a through 1.1 inclusive. The vulnerability was published on 2025-01-22 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

A network-based attacker requires no privileges and can exploit this with low attack complexity by tricking an authenticated user into performing an action, such as interacting with a maliciously crafted request. Exploitation enables limited impacts on confidentiality, integrity, and availability in a context with changed scope, allowing potential execution of arbitrary scripts in the victim's browser.

The primary advisory from Patchstack documents this reflected XSS vulnerability specifically in the WordPress Tagesteller plugin up to version 1.1, available at https://patchstack.com/database/Wordpress/Plugin/tagesteller/vulnerability/wordpress-tagesteller-plugin-v-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.