CVE-2025-23645

CVE-2025-23645 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (CWE-79), in the Optimize Worldwide Find Content IDs (find-content-ids) WordPress plugin. This issue affects all versions of the plugin from n/a through 1.0 inclusive. The vulnerability was published on 2025-02-04.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, and user interaction needed for exploitation, with changed scope and low impacts on confidentiality, integrity, and availability. Remote attackers can exploit it by crafting malicious inputs that reflect unsanitized user-supplied data in web page generation, potentially executing scripts in the context of a victim's browser upon interaction, such as clicking a crafted link.

The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/find-content-ids/vulnerability/wordpress-find-content-ids-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve) documents the Reflected XSS vulnerability in the Find Content IDs WordPress plugin version 1.0.