CVE-2025-25113

The Implied Cookie Consent plugin for WordPress versions through 1.3 suffers from a reflected Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation [1]. This means user-supplied data is echoed back without sufficient sanitization or output encoding, enabling script injection.

Exploitation requires user interaction—e.g., clicking a crafted link or submitting a malicious form—but no authentication is needed [1]. The attack surface is broad, as the vulnerability can be triggered by any visitor to a site running the plugin.

Successful exploitation could allow an attacker to inject arbitrary HTML and JavaScript payloads, such as redirects, advertisements, or other scripts that execute when victims visit the affected site [1]. This could lead to defacement, phishing, or further compromise of the site and its visitors.

The plugin author has not released a patch, and users are advised to update if available; otherwise, seek assistance from a hosting provider or web developer [1]. This vulnerability is noted as being actively used in mass-exploit campaigns [1].