CVE-2025-23744

CVE-2025-23744 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the WordPress plugin Random Posts, Mp3 Player + ShareButton by dvs11. This issue affects all versions of the plugin from unknown initial release through 1.4.1. The vulnerability was published on 2025-03-15 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility and scope change.

Attackers can exploit this Reflected XSS remotely over the network with low attack complexity and no privileges required, though successful exploitation depends on user interaction, such as a victim clicking a malicious link or interacting with crafted input that gets reflected unsanitized into the web page. This allows limited impacts on confidentiality, integrity, and availability within a changed security scope, potentially enabling theft of user session data, defacement, or further phishing within the site's context.

Patchstack advisories detail the Reflected XSS vulnerability specifically in the random-posts-mp3-player-sharebutton WordPress plugin up to version 1.4.1, providing analysis for mitigation guidance. Security practitioners should consult the referenced advisory at https://patchstack.com/database/Wordpress/Plugin/random-posts-mp3-player-sharebutton/vulnerability/wordpress-random-posts-mp3-player-sharebutton-plugin-1-4-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve for recommended actions, such as plugin updates or removal if no patch is available.