CVE-2025-23574

CubePM WordPress plugin versions ≤ 1.0 suffer from a reflected cross-site scripting (XSS) vulnerability due to improper neutralization of user input during web page generation [1]. This allows an attacker to inject arbitrary HTML and JavaScript into a web page, which is then executed in the context of the victim's browser.

Exploitation requires user interaction, such as clicking a specially crafted link or visiting a malicious page. The attacker does not need authentication, but the victim must be a logged-in user or have some privileged role for certain actions [1].

Successful exploitation can lead to script execution that may steal sensitive data, perform actions on behalf of the victim, redirect users to malicious sites, or serve advertisements [1].

As of the advisory, the vendor has not released a patch. Patchstack has provided a mitigation rule to block attacks until an official fix is available. Users are advised to update the plugin when a patch is released or apply the mitigation rule [1].