CVE-2025-23813

Vulnerability

Overview CVE-2025-23813 is a reflected cross-site scripting (XSS) vulnerability in the Guten Free Options WordPress plugin, versions 0.9.7 and earlier. The plugin fails to properly neutralize user input during web page generation, enabling an attacker to inject arbitrary HTML and JavaScript into a response page. [1]

Exploitation

Conditions Exploitation requires user interaction—a victim must click a crafted link or visit a maliciously prepared page. The attacker does not need authentication, as reflected XSS can be triggered via HTTP GET or POST parameters. This makes the vulnerability suitable for mass-exploit campaigns targeting multiple sites simultaneously. [1]

Impact

Successful exploitation allows an attacker to inject scripts that execute in the context of the victim's browser. This can lead to redirection to malicious sites, display of unwanted advertisements, theft of session cookies, or defacement of the page. The CVSS v3 base score is 7.1 (High), reflecting the moderate complexity but significant potential for harm. [1]

Mitigation

Users are advised to update the Guten Free Options plugin as soon as a patched version becomes available. As a temporary measure, Patchstack has released a mitigation rule to block exploitation attempts. Site administrators should apply the update or consult their hosting provider for immediate assistance. [1]