CVE-2025-23736

Vulnerability

Overview

The Form To JSON WordPress plugin versions up to and including 1.0 suffer from a reflected Cross-Site Scripting (XSS) vulnerability due to improper neutralization of user-supplied input during web page generation [1]. This allows an attacker to inject arbitrary HTML and JavaScript code that is reflected back to the user.

Exploitation

Details

An attacker can exploit this vulnerability by crafting a malicious URL or form submission that includes a payload. Successful exploitation requires user interaction, such as clicking a specially crafted link or visiting a manipulated page [1]. The vulnerability can be triggered without authentication, making it accessible to any visitor.

Impact

If exploited, an attacker can execute malicious scripts in the context of the victim's browser. This can lead to session hijacking, redirection to malicious sites, injection of advertisements, or theft of sensitive information [1].

Mitigation

As of the publication date, no official patch has been released for the plugin. Users are advised to update the plugin as soon as a fix becomes available. In the meantime, Patchstack offers a virtual mitigation rule to block attacks [1]. Given the expected mass exploitation, immediate action is recommended.