CVE-2025-23538 describes a reflected cross-site scripting vulnerability in the WP Contest plugin by Sophia M Williams. The issue is caused by improper neutralization of input during web page generation, which allows attackers to inject malicious scripts that execute in users' browsers. This affects WP Contest versions up to 1.0.0. The vulnerability has a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating it can be exploited remotely over the network with low attack complexity and no privileges required, but user interaction is necessary. The impact includes partial confidentiality, integrity, and availability loss. No patch or vendor advisory is currently provided, and no known exploits have been reported.

Successful exploitation of this reflected XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of a victim's browser, potentially leading to partial disclosure of confidential information, modification of data, or disruption of availability. The CVSS score of 7.1 reflects a high severity with impacts on confidentiality, integrity, and availability. However, no known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or advisory is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider applying web application firewall (WAF) rules to detect and block reflected XSS attempts targeting this plugin. Avoid clicking on suspicious links that could exploit this vulnerability.