CVE-2025-23650

CVE-2025-23650 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, affecting the Tidy.ro WordPress plugin developed by razvypp. This issue impacts all versions of the plugin from n/a through 1.3 inclusive, as published on 2025-02-14 with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

The vulnerability enables remote attackers to exploit it over the network with low attack complexity and no privileges required, though user interaction is necessary. Exploitation involves injecting malicious scripts via reflected input, allowing attackers to execute code in the context of affected users' browsers and achieve low impacts on confidentiality, integrity, and availability with a changed scope.

Patchstack has documented this Reflected XSS vulnerability in their database entry for the WordPress Tidy.ro plugin version 1.3, providing details on the issue.