Cross-Site Scripting Vulnerability in Call To Action Popup by LamPD
CVE-2025-23605

7.1HIGH

Key Information:

Vendor

WordPress
Status
Call To Action Popup
Vendor
CVE Published:
22 January 2025

What is CVE-2025-23605?

The Call To Action Popup plugin developed by LamPD is affected by a reflected cross-site scripting (XSS) vulnerability. This flaw allows attackers to inject malicious scripts into web pages, potentially compromising users' data and hijacking their sessions. The vulnerability exists across versions, from n/a to 1.0.2, posing a significant risk to websites utilizing this plugin. Website administrators are advised to update to the latest version and implement necessary security measures to mitigate the impact of this vulnerability.

Affected Version(s)

Call To Action Popup <= 1.0.2

References

https://patchstack.com/database/wordpress/plugin/call-to-...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Le Ngoc Anh (Patchstack Alliance)
.