CVE-2025-23738

The Ps Ads Pro plugin for WordPress, versions 1.0.0 and earlier, contains a reflected cross-site scripting (XSS) vulnerability due to improper neutralization of user-supplied input during web page generation [1]. This flaw enables an attacker to inject arbitrary HTML and JavaScript into the application's response.

Exploitation requires user interaction, such as clicking a crafted link or visiting a specially prepared page [1]. The vulnerability is considered moderately dangerous and is expected to be used in mass-exploit campaigns targeting thousands of websites regardless of their size or popularity [1].

Successful exploitation allows an attacker to execute malicious scripts in the context of the victim's browser, potentially leading to redirects, injection of advertisements, theft of session cookies, or other harmful actions [1].

As of the publication date, no official patch has been released. Users are advised to update the plugin immediately when a fix becomes available or apply a mitigation rule from Patchstack to block attacks until an official patch can be safely deployed [1].