CVE-2025-23735

CVE-2025-23735 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Infugrator WordPress plugin developed by Cosmin Schiopu. This issue affects Infugrator versions from n/a through 1.0.3 inclusive. The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges, user interaction requirement, and scope change.

An unauthenticated remote attacker can exploit this vulnerability by crafting malicious input that is reflected back in a web page generated by the plugin. The attacker typically tricks a victim user—such as a site administrator or authenticated visitor—into interacting with the malicious payload, for example by clicking a phishing link or visiting a tainted URL. Upon successful exploitation, the attacker can execute arbitrary JavaScript in the victim's browser context, achieving low impacts on confidentiality (e.g., limited data exposure), integrity (e.g., minor tampering), and availability (e.g., minor denial of service).

The primary advisory reference is from Patchstack at https://patchstack.com/database/Wordpress/Plugin/infugrator/vulnerability/wordpress-infugrator-plugin-1-0-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve, which documents the vulnerability in the WordPress Infugrator plugin version 1.0.3.