CVE-2025-23722

CVE-2025-23722 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Mind3doM RyeBread Widgets WordPress plugin (mind3dom-ryebread-widgets). This issue affects all versions from n/a through 1.0 inclusive. The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), reflecting network accessibility, low complexity, no required privileges, user interaction, scope change, and low impacts across confidentiality, integrity, and availability.

A remote, unauthenticated attacker can exploit this vulnerability by crafting malicious input that is reflected back in web page generation, tricking a user into interacting with it—such as clicking a malicious link. Successful exploitation executes arbitrary JavaScript in the victim's browser context, potentially enabling actions like session hijacking, data theft, or further phishing within the scope changed by the cross-origin effects.

Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/mind3dom-ryebread-widgets/vulnerability/wordpress-mind3dom-ryebread-widgets-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve documents the vulnerability in the WordPress plugin context.