CVE-2025-23711
Published: 24 January 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-23711 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the WordPress plugin "Quote me" by Quincy Kwende. The issue affects the plugin from unknown initial versions through 1.0 inclusive.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, and user interaction needed for exploitation, with a changed scope. Remote attackers can exploit it by tricking authenticated or unauthenticated users into interacting with malicious input, such as a crafted link or form submission, potentially leading to execution of arbitrary scripts in the victim's browser context and limited impacts on confidentiality, integrity, and availability.
Patchstack provides details on this vulnerability in their database entry for the WordPress Quote me plugin 1.0 reflected XSS issue at https://patchstack.com/database/Wordpress/Plugin/quote-me/vulnerability/wordpress-quote-me-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables exploitation of the web application via crafted links or inputs to execute arbitrary scripts in the victim's browser.