CVE-2025-23658

CVE-2025-23658 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as reflected cross-site scripting (XSS) under CWE-79, in the Advanced Angular Contact Form WordPress plugin by Tauhidul Alam. This issue affects the plugin from unknown initial versions through version 1.1.0.

A remote, unauthenticated attacker can exploit this vulnerability over the network with low attack complexity by crafting malicious input that is reflected in the generated web page, requiring user interaction such as clicking a link. The CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) indicates high severity, enabling limited impacts on confidentiality, integrity, and availability within a changed scope, such as executing scripts in the victim's browser context.

Patchstack has documented this vulnerability in their database for the Advanced Angular Contact Form WordPress plugin, detailing the reflected XSS in version 1.1.0.