CVE-2025-23652
Published: 14 February 2025
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fabio Zuanon Add custom content after post add-custom-content-after-post allows Reflected XSS.This issue affects Add custom content after post: from n/a through <= 1.0.
Security Summary
CVE-2025-23652 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the WordPress plugin "Add custom content after post" by Fabio Zuanon. The plugin, identified as add-custom-content-after-post, is affected in all versions from n/a through 1.0 inclusive. Published on 2025-02-14T13:15:45.333, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
An unauthenticated attacker with network access can exploit this vulnerability through low-complexity attacks that require user interaction, such as tricking a victim into visiting a malicious URL. Exploitation enables script execution in the victim's browser context within the scope of the affected site, resulting in low impacts to confidentiality, integrity, and availability, with a changed scope.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/add-custom-content-after-post/vulnerability/wordpress-add-custom-content-after-post-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)