CVE-2025-28924

CVE-2025-28924 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Simbul ZenphotoPress (zenphotopress) WordPress plugin. This issue affects all versions of ZenphotoPress from n/a through 1.8 inclusive. The vulnerability was published on 2025-03-26 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

Attackers can exploit this Reflected XSS over the network with low attack complexity and no required privileges, though it demands user interaction such as clicking a malicious link. Exploitation changes the security scope, enabling arbitrary script execution in the victim's browser context, which could result in low-level impacts to confidentiality, integrity, and availability, such as session hijacking or minor data manipulation.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/zenphotopress/vulnerability/wordpress-zenphotopress-plugin-1-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve documents this Reflected XSS vulnerability specifically in the WordPress ZenphotoPress plugin version 1.8, providing further technical details for security practitioners to assess and address exposure.