CVE-2025-23616

Vulnerability

Overview CVE-2025-23616 is a reflected cross-site scripting (XSS) vulnerability in the WordPress Canalplan plugin, version 5.31 and earlier. The issue stems from improper neutralization of user input during web page generation, allowing attackers to inject arbitrary HTML and JavaScript.

Exploitation

This vulnerability can be exploited remotely without authentication, but requires user interaction. An attacker must trick a victim (such as a site administrator) into clicking a specially crafted link or visiting a malicious page. The injected script executes in the context of the victim's browser on the affected WordPress site.

Impact

Successful exploitation enables an attacker to perform actions such as redirecting visitors, displaying advertisements, or stealing sensitive information. This type of vulnerability is commonly used in mass-exploit campaigns targeting WordPress sites.

Mitigation

As a permanent fix, users should update the Canalplan plugin to a patched version once available. Until then, Patchstack has provided a virtual mitigation rule to block attacks. Immediate action is recommended to reduce risk of exploitation [1].