CVE-2025-23700

CVE-2025-23700 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Reflected Cross-site Scripting (XSS) as classified under CWE-79. It affects the yCyclista WordPress plugin developed by yonisink, with all versions from n/a through 1.2.3 vulnerable. The issue was published on 2025-01-22.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, and user interaction needed for exploitation, with changed scope and low impacts on confidentiality, integrity, and availability. Remote attackers can exploit it by tricking authenticated or unauthenticated users into interacting with malicious input, such as clicking a crafted link, to inject and execute arbitrary scripts in the victim's browser context.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/ycyclista/vulnerability/wordpress-ycyclista-plugin-1-2-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve details the Reflected XSS vulnerability in the yCyclista WordPress plugin up to version 1.2.3 and provides guidance on mitigation.