CVE-2025-25157

CVE-2025-25157 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79. It affects the WP Church Center WordPress plugin (wp-church-center) developed by wpchurchteam, impacting all versions from n/a through 1.3.3 inclusive. The vulnerability was published on 2025-03-03.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, and user interaction such as clicking a malicious link. Remote attackers can exploit it by tricking users into interacting with crafted inputs that reflect unsanitized data back into the web page, enabling arbitrary script execution in the victim's browser context with changed scope and low impacts to confidentiality, integrity, and availability.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp-church-center/vulnerability/wordpress-wp-church-center-plugin-1-3-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.