CVE-2025-23450

The AW WooCommerce Kode Pembayaran plugin for WordPress versions up to and including 1.1.4 contains a reflected cross-site scripting (XSS) vulnerability. This arises from improper neutralization of user input during web page generation, allowing an attacker to inject arbitrary HTML and JavaScript into a response.

Exploitation requires a privileged user to click a malicious link or visit a specially crafted page. The attacker does not need prior authentication but must trick a user with sufficient privileges, such as an administrator, into performing the action.

Successful exploitation enables the attacker to execute malicious scripts in the context of the victim's session. This can lead to redirects, injection of advertisements, or other HTML payloads, potentially compromising the website's integrity and affecting visitors.

As of the advisory, Patchstack has issued a mitigation rule to block attacks until an official patch is available. Users are advised to update the plugin once a security release is provided or apply the mitigation rule to protect their sites [1].