CVE-2025-23754

The vulnerability is a reflected Cross-Site Scripting (XSS) in the WordPress plugin 'The Loops' versions up to and including 1.0.2. The root cause is improper neutralization of user-supplied input during web page generation, allowing an attacker to inject arbitrary HTML and JavaScript into the response [1].

Exploitation requires the attacker to craft a malicious link or request that, when clicked by a privileged user (such as an administrator), executes the injected script. No authentication is needed for the attacker, but user interaction is necessary. The attack surface includes any page that incorporates the plugin's functionality [1].

Successful exploitation enables the attacker to inject malicious scripts that can perform actions such as redirecting visitors, displaying advertisements, or stealing session cookies. This could lead to further compromise of the WordPress site or its users [1].

As a mitigation, users should update the plugin to a patched version immediately. Patchstack has issued a mitigation rule to block attacks until an official patch is applied. If updating is not possible, consulting a hosting provider or web developer is advised [1].