CVE-2025-23756

CVE-2025-23756 is a reflected cross-site scripting (XSS) vulnerability stemming from improper neutralization of input during web page generation, classified under CWE-79. It affects the LawPress – Law Firm Website Management WordPress plugin by ivanchernyakov, impacting all versions from n/a through 1.4.5 inclusive. The issue was published on 2025-01-27 with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to network accessibility, low attack complexity, and scope change despite requiring user interaction.

A remote, unauthenticated attacker can exploit this vulnerability by crafting malicious input that is reflected back in the web page without proper sanitization, tricking victims into accessing a malicious URL via social engineering, such as phishing links. Upon execution in the victim's browser context, the injected script can achieve limited impacts: low confidentiality (e.g., potential session token theft), low integrity (e.g., minor page manipulation), and low availability (e.g., resource consumption), elevated by the changed scope to other resources.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/lawpress/vulnerability/wordpress-lawpress-plugin-1-4-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve, which documents the vulnerability in the WordPress LawPress plugin up to version 1.4.5. Security practitioners should update to a patched version if available and apply general XSS protections like content security policy (CSP) headers.