CVE-2025-23679

CVE-2025-23679 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Reflected Cross-site Scripting (XSS) as classified under CWE-79. It affects the Flourish Pixel FP RSS Category Excluder WordPress plugin (fp-rss-category-excluder) in all versions from n/a through 1.0.0. The issue was published on 2025-01-22 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

Attackers can exploit this vulnerability remotely over the network with low complexity and no required privileges, though it necessitates user interaction such as clicking a malicious link or submitting crafted input to a vulnerable site. Exploitation reflects unsanitized input into web pages, allowing arbitrary JavaScript execution in the victim's browser context. With a changed scope (S:C), this can result in low impacts to confidentiality, integrity, and availability, such as session hijacking or data theft from authenticated users.

The primary advisory from Patchstack documents the Reflected XSS in FP RSS Category Excluder version 1.0.0 and is available at https://patchstack.com/database/Wordpress/Plugin/fp-rss-category-excluder/vulnerability/wordpress-fp-rss-category-excluder-plugin-1-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve. Practitioners should review this resource for detailed mitigation steps, including any available patches or workarounds.