Reflected XSS Vulnerability in Easy Bet Plugin by NotFound
CVE-2025-23787

7.1HIGH

Key Information:

Vendor
WordPress
Status
Easy Bet
Vendor
CVE Published:
14 February 2025

Summary

An improper neutralization of input during web page generation in NotFound's Easy Bet plugin leads to a reflected cross-site scripting (XSS) vulnerability. This security flaw allows attackers to inject arbitrary scripts into the web pages viewed by users, facilitating unauthorized actions and data exposure. The affected versions include all iterations from n/a to 1.0.7, highlighting a significant risk for users relying on this plugin for their web applications.

Affected Version(s)

Easy Bet <= 1.0.7

References

https://patchstack.com/database/wordpress/plugin/easy-bet...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Le Ngoc Anh (Patchstack Alliance)
.