CVE-2025-24570

CVE-2025-24570 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Stored Cross-site Scripting (XSS) under CWE-79, in the Atarim Visual Collaboration plugin developed by Vito Peleg. This issue affects the Atarim WordPress plugin in all versions up to and including 4.0.8. The vulnerability was published on 2025-01-24 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

Unauthenticated attackers can exploit this Stored XSS vulnerability over the network with low complexity, requiring user interaction such as viewing a maliciously crafted page. By injecting unsanitized input that is stored and later rendered without proper neutralization, attackers can execute arbitrary scripts in the context of other users who access the affected content, achieving low impacts on confidentiality, integrity, and availability with a changed scope.

The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/atarim-visual-collaboration/vulnerability/wordpress-atarim-plugin-4-0-8-cross-site-scripting-xss-vulnerability?_s_id=cve) documents this XSS vulnerability in the Atarim WordPress plugin version 4.0.8. Security practitioners should consult this reference for guidance on available patches and mitigation recommendations.