CVE-2025-23489 is a reflected cross-site scripting vulnerability in the WP-Announcements WordPress plugin by Brian Messenlehner, affecting versions up to 1.8. The vulnerability is caused by improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that execute when a user views a crafted URL or input. The CVSS 3.1 score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and no exploits are known in the wild.

Successful exploitation of this vulnerability can lead to reflected XSS attacks, which may allow attackers to execute arbitrary scripts in the context of the victim's browser. This can result in partial loss of confidentiality, integrity, and availability of user data or session information. The CVSS score of 7.1 reflects a high severity impact, but no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users of WP-Announcements should monitor the vendor's communications for updates. In the meantime, consider applying web application firewall (WAF) rules to detect and block reflected XSS attempts if possible. Avoid clicking on suspicious links that may exploit this vulnerability.