CVE-2025-23837

CVE-2025-23837 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, affecting the WordPress plugin "One Backend Language" (one-backend-language) by martinjuhasz. This issue impacts all versions from n/a through <=1.0. Published on 2025-01-24T11:15:11.240, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to network accessibility and scope change.

Unauthenticated attackers accessible over the network can exploit this with low attack complexity by tricking users into interacting, such as via a malicious link or input reflected in web page generation. Exploitation enables arbitrary script execution in the victim's browser context on the affected site, resulting in low impacts to confidentiality (e.g., limited data exposure), integrity (e.g., minor modifications), and availability (e.g., minor disruptions), amplified by the changed scope.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/one-backend-language/vulnerability/wordpress-one-backend-language-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve documents the Reflected XSS in the WordPress One Backend Language plugin version 1.0 and provides vulnerability details for mitigation.