CVE-2025-23648
Published: 14 February 2025
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wjharil AdsMiddle adsmiddle allows Reflected XSS.This issue affects AdsMiddle: from n/a through <= 1.0.
Security Summary
CVE-2025-23648 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the AdsMiddle WordPress plugin by wjharil. This issue affects AdsMiddle versions from n/a through 1.0 inclusive. Published on 2025-02-14, it carries a CVSS v3.1 base score of 7.1.
The vulnerability enables exploitation over the network (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) but user interaction (UI:R), and results in a changed scope (S:C) with low impacts on confidentiality, integrity, and availability (C:L/I:L/A:L). Remote attackers can craft malicious links or inputs that, when interacted with by users visiting affected sites, trigger reflected XSS payloads in the browser context, potentially leading to session hijacking, data exfiltration, or other client-side script execution.
Patchstack has documented this vulnerability in an advisory specific to the WordPress AdsMiddle plugin version 1.0, available at https://patchstack.com/database/Wordpress/Plugin/adsmiddle/vulnerability/wordpress-adsmiddle-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)