CVE-2025-23611

CVE-2025-23611 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as CWE-79, enabling Reflected Cross-Site Scripting (XSS) in the WH Cache & Security WordPress plugin developed by webhue (package name wh-cache-and-security). The flaw affects all versions of the plugin up to and including 1.1.2. It has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges, and scope change.

Attackers can exploit this vulnerability remotely without authentication by crafting malicious payloads that reflect user input on web pages generated by the plugin. Exploitation requires user interaction, such as a victim clicking a specially crafted link or visiting a malicious site, which triggers the XSS in the browser context of the targeted WordPress site. Successful attacks can lead to low-level impacts on confidentiality (e.g., limited data exposure like cookies), integrity (e.g., minor script injection), and availability, with the changed scope allowing cross-origin effects.

Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/wh-cache-and-security/vulnerability/wordpress-wh-cache-security-plugin-1-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve details the vulnerability and serves as a primary reference for mitigation guidance, though specific patch availability or workaround instructions are outlined there for affected WordPress administrators.