CVE-2025-23614

CVE-2025-23614 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the WordPress plugin Additional Logins (wp-additional-logins) by niksudan. The issue affects all versions of the plugin from n/a through 1.0.0 inclusive. Published on 2025-02-03, it carries a CVSS v3.1 base score of 7.1.

Attackers can exploit this vulnerability remotely over the network (AV:N) with low attack complexity (AC:L), no privileges required (PR:N), but it requires user interaction (UI:R), such as visiting a maliciously crafted link. Exploitation changes scope (S:C) and results in low impacts to confidentiality, integrity, and availability (C:L/I:L/A:L), allowing arbitrary script execution in the context of the victim's browser on sites running the affected plugin.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp-additional-logins/vulnerability/wordpress-wordpress-additional-logins-plugin-1-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve. Security practitioners should verify plugin versions and apply updates if a patched release exists.