CVE-2025-23686
Published: 22 January 2025
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phpdevca Admin Menu Organizer admin-menu-organizer allows Reflected XSS.This issue affects Admin Menu Organizer: from n/a through <= 1.0.1.
Security Summary
CVE-2025-23686 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the phpdevca Admin Menu Organizer WordPress plugin (admin-menu-organizer). This issue affects all versions from n/a through 1.0.1, as published on 2025-01-22.
The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating it is exploitable over the network with low attack complexity by unauthenticated attackers (no privileges required) who can trick users into performing an action such as clicking a malicious link. Successful exploitation enables reflected XSS, allowing limited impacts on confidentiality, integrity, and availability within a changed scope.
Patchstack provides details on the vulnerability in the Admin Menu Organizer plugin version 1.0.1; security practitioners should consult the advisory at https://patchstack.com/database/Wordpress/Plugin/admin-menu-organizer/vulnerability/wordpress-admin-menu-organizer-plugin-1-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve for mitigation guidance and patches.
Details
- CWE(s)