CVE-2025-23959

CVE-2025-23959 is an improper neutralization of input during web page generation vulnerability, enabling reflected cross-site scripting (XSS) as classified under CWE-79. It affects the Good Old Gallery WordPress plugin by Linus Lundahl, with the issue present in all versions from n/a through 2.1.2. Published on 2025-01-22, the vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), reflecting its high severity due to network accessibility, low complexity, lack of required privileges, user interaction requirement, and changed scope.

The vulnerability can be exploited by unauthenticated attackers over the network with low attack complexity. Exploitation typically involves tricking a user into interacting with a maliciously crafted link or input that gets reflected unsanitized into the web page. This allows attackers to execute arbitrary scripts in the victim's browser context, achieving low impacts on confidentiality (e.g., potential session data exposure), integrity (e.g., minor data manipulation), and availability, amplified by the cross-origin scope change.

The primary advisory from Patchstack, available at https://patchstack.com/database/Wordpress/Plugin/good-old-gallery/vulnerability/wordpress-good-old-gallery-plugin-2-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve, details the vulnerability in the context of the WordPress plugin. Security practitioners should review this reference for mitigation guidance, such as applying available patches or updates to affected versions.