CVE-2025-23657: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in RusAlex WordPress-to-candidate for Salesforce CRM
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RusAlex WordPress-to-candidate for Salesforce CRM salesforce-wordpress-to-candidate allows Reflected XSS.This issue affects WordPress-to-candidate for Salesforce CRM: from n/a through <= 1.0.1.
AI Analysis
Technical Summary
This vulnerability involves improper neutralization of input during web page generation in the RusAlex WordPress-to-candidate for Salesforce CRM plugin, leading to reflected Cross-site Scripting (XSS). It affects versions up to and including 1.0.1. The CVSS 3.1 base score is 7.1, indicating high severity, with an attack vector of network, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability. The product is cloud-hosted, and the vendor manages remediation for this service.
Potential Impact
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of a user's browser, potentially leading to information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. However, there are no known exploits in the wild currently.
Mitigation Recommendations
A patch is available for this vulnerability. Since the product is a cloud-hosted service, the vendor typically manages remediation server-side. Users should verify with the vendor advisory that the patch has been applied or that the service is updated to mitigate this issue.
CVE-2025-23657: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in RusAlex WordPress-to-candidate for Salesforce CRM
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RusAlex WordPress-to-candidate for Salesforce CRM salesforce-wordpress-to-candidate allows Reflected XSS.This issue affects WordPress-to-candidate for Salesforce CRM: from n/a through <= 1.0.1.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves improper neutralization of input during web page generation in the RusAlex WordPress-to-candidate for Salesforce CRM plugin, leading to reflected Cross-site Scripting (XSS). It affects versions up to and including 1.0.1. The CVSS 3.1 base score is 7.1, indicating high severity, with an attack vector of network, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability. The product is cloud-hosted, and the vendor manages remediation for this service.
Potential Impact
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of a user's browser, potentially leading to information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. However, there are no known exploits in the wild currently.
Mitigation Recommendations
A patch is available for this vulnerability. Since the product is a cloud-hosted service, the vendor typically manages remediation server-side. Users should verify with the vendor advisory that the patch has been applied or that the service is updated to mitigate this issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Patchstack
- Date Reserved
- 2025-01-16T11:27:51.185Z
- Cvss Version
- null
- State
- PUBLISHED
- Is Cloud Service
- true
Threat ID: 69cd7647e6bfc5ba1df0ae87
Added to database: 4/1/2026, 7:47:19 PM
Last enriched: 5/12/2026, 3:36:37 AM
Last updated: 5/20/2026, 8:56:09 PM
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.