CVE-2025-23589 describes a reflected cross-site scripting (XSS) vulnerability in the markugwuanyi ContentOptin Lite plugin, versions up to 1.1. The issue is caused by improper neutralization of input during web page generation, which allows attackers to inject malicious scripts that execute in users' browsers when they visit crafted URLs or interact with vulnerable pages. The vulnerability has a CVSS 3.1 base score of 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and impacts on confidentiality, integrity, and availability. No patch or official remediation guidance is currently provided by the vendor, and no exploits are known to be in the wild.

Successful exploitation of this reflected XSS vulnerability can lead to the execution of arbitrary scripts in the context of the victim's browser. This may result in the theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability of user data. The CVSS score of 7.1 indicates a high impact level. However, there are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or limiting use of the affected ContentOptin Lite plugin versions. Implementing web application firewall (WAF) rules to detect and block reflected XSS payloads may provide temporary mitigation. Monitor vendor channels for updates and apply patches promptly once available.