CVE-2025-22595

The vulnerability is a Reflected Cross-Site Scripting (XSS) found in the Mailing Group Listserv plugin for WordPress, affecting versions from n/a through 2.0.9. The root cause is improper neutralization of user input during web page generation, allowing an attacker to inject arbitrary web scripts or HTML [1].

To exploit this, an attacker must trick a privileged user into clicking a malicious link or visiting a crafted page. User interaction is required, and the attacker does not need prior authentication to the vulnerable site [1]. The attack can be initiated remotely without special network access.

Successful exploitation could allow the attacker to inject malicious scripts, such as redirects, advertisements, or other HTML payloads. These scripts execute in the context of the victim's browser when they visit the affected site, potentially leading to data theft, session hijacking, or defacement [1].

The vulnerability is patched in version 3.0.0 or later. Users are strongly advised to update immediately. Patchstack has also issued a mitigation rule to block attacks until an update is applied [1].