CVE-2025-23701

CVE-2025-23701 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Lime Developer Login WordPress plugin developed by limesquare. The issue affects all versions of the lime-developer-login plugin up to and including 1.4.0, as published on 2025-01-22.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, and user interaction such as clicking a malicious link. Unauthenticated attackers can exploit it by tricking targeted users—likely site administrators or developers—into accessing crafted payloads reflected in the login page, enabling script execution in the site's context due to scope change, with low impacts on confidentiality, integrity, and availability.

Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/lime-developer-login/vulnerability/wordpress-lime-developer-login-plugin-1-4-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve documents the vulnerability in the Lime Developer Login WordPress plugin and provides associated mitigation guidance.