CVE-2025-23792

CVE-2025-23792 is an Improper Neutralization of Input During Web Page Generation vulnerability, manifesting as Reflected Cross-site Scripting (XSS) and classified under CWE-79. It affects the WordPress plugin "Passwordless WP – Login with your glance or fingerprint" (passwordless-wp) in all versions from n/a through 1.1.6.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). An unauthenticated attacker accessible over the network can exploit it with low attack complexity by tricking a user into performing an action, such as interacting with a malicious link or request. Exploitation enables script execution in the context of the victim's browser on the affected site, resulting in low impacts to confidentiality, integrity, and availability, accompanied by a scope change.

Patchstack documents this issue in their vulnerability database for the plugin at https://patchstack.com/database/Wordpress/Plugin/passwordless-wp/vulnerability/wordpress-passwordless-wp-login-with-your-glance-or-fingerprint-plugin-1-1-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve, which security practitioners should consult for mitigation guidance, such as updating to a non-vulnerable version beyond 1.1.6.