Reflected XSS Vulnerability in HyperComments Plugin by NotFound
CVE-2025-23509

7.1HIGH

Key Information:

Vendor

WordPress
Status
Hypercomments
Vendor
CVE Published:
22 January 2025

What is CVE-2025-23509?

The NotFound HyperComments plugin is susceptible to a reflected Cross-site Scripting (XSS) vulnerability that occurs due to improper neutralization of user input during web page generation. This issue can allow an attacker to inject malicious scripts, potentially compromising user sessions or stealing sensitive data. The vulnerability affects all versions of HyperComments up to and including 0.9.6, highlighting the importance of immediate remediation to safeguard WordPress sites.

Affected Version(s)

HyperComments <= 0.9.6

References

https://patchstack.com/database/wordpress/plugin/comments...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

João Pedro S Alcântara (Kinorth) (Patchstack Alliance)
.