CVE-2025-23746

WordPress CMC MIGRATE plugin <= 0.0.3 - Reflected Cross Site Scripting (XSS) vulnerability

View on CVE.org
Published Jan 22, 2025 CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Edem CMC MIGRATE cmc-migrate allows Reflected XSS.This issue affects CMC MIGRATE: from n/a through <= 0.0.3.

Analysis

AI-generated

Technical impact

Improper neutralization of user input during page rendering in the Edem CMC MIGRATE plugin allows reflected cross‑site scripting. An attacker can embed malicious script content in a URL, which the plugin then outputs without adequate sanitization, causing the script to execute in the victim’s browser, potentially exposing client‑side data.

Affected Systems

All installations of the WordPress CMC MIGRATE plugin from its first release through version 0.0.3 are affected.

Risk and Exploitability

The CVSS score of 7.1 indicates high severity, while the EPSS score of < 1% suggests a currently low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is user‑directed web traffic; an attacker must craft a URL containing malicious script payloads that the victim accesses, triggering execution in the browser.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the CMC MIGRATE plugin to a version newer than 0.0.3 to remove the identified XSS flaw
  • If an update cannot be applied immediately, deploy a web application firewall or similar solution to block reflected XSS payloads from reaching the browser
  • Audit the plugin’s input handling to confirm that all user‑provided data is properly encoded before rendering, addressing the underlying CWE‑79 weakness

Generated by OpenCVE AI on May 2, 2026 at 09:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-3384 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound CMC MIGRATE allows Reflected XSS. This issue affects CMC MIGRATE: from n/a through 0.0.3.
History
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound CMC MIGRATE allows Reflected XSS. This issue affects CMC MIGRATE: from n/a through 0.0.3. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Edem CMC MIGRATE cmc-migrate allows Reflected XSS.This issue affects CMC MIGRATE: from n/a through <= 0.0.3.
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound CMC MIGRATE allows Reflected XSS. This issue affects CMC MIGRATE: from n/a through 0.0.3.
Title WordPress CMC MIGRATE plugin <= 0.0.3 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

No data.

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
May 11, 2026, 11:07 PM
Reserved
Jan 16, 2025, 11:29 AM

View source JSON

Updated
Jan 22, 2025, 3:10 PM

JSON

Status
Deferred
Published
Jan 22, 2025, 3:15 PM
Modified
Jun 17, 2026, 8:56 AM

View source JSON

No data.

Updated
May 2, 2026, 9:45 AM

JSON