CVE-2025-23683

CVE-2025-23683 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79. It affects the MACME macme component from xdxdVSxdxd, with the issue impacting versions from n/a through 1.2. The vulnerability has a CVSS v3.1 base score of 7.1, rated High, with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L.

Attackers can exploit this remotely over the network with low attack complexity and no required privileges, though it necessitates user interaction such as clicking a malicious link. Successful exploitation changes scope to the victim's browser context, potentially allowing limited impacts on confidentiality, integrity, and availability, such as script execution leading to session token theft or phishing within the affected site.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/macme/vulnerability/wordpress-macme-plugin-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve details the reflected XSS in the WordPress MACME plugin version 1.2.