CVE-2025-23739

Summary

The WP Ultimate Reviews FREE plugin for WordPress suffers from a reflected cross-site scripting (XSS) vulnerability due to improper neutralization of user input during web page generation [1]. This affects all versions up to and including 1.0.2.

Exploitation

An attacker can exploit this vulnerability by crafting a malicious link containing the XSS payload. The victim, typically a privileged user, must click the link or interact with a crafted page. No authentication is required from the attacker, but user interaction is necessary [1].

Impact

Successful exploitation allows the attacker to inject arbitrary HTML and JavaScript into the context of the victim's browser. This can lead to redirects, display of advertisements, or other malicious actions when visitors access the affected site [1]. The vulnerability is considered moderately dangerous and is expected to be used in mass-exploit campaigns.

Mitigation

Users are strongly advised to update the plugin to a patched version as soon as possible. If an immediate update is not feasible, Patchstack offers a mitigation rule to block attacks until an official patch can be applied [1].