The vulnerability CVE-2025-23671 affects the sav WP OpenSearch plugin for WordPress, specifically versions up to 1.0. It is a stored cross-site scripting (XSS) flaw caused by improper neutralization of input during web page generation. This allows attackers to inject malicious scripts that persist on the site and execute in the context of users' browsers, potentially leading to information disclosure, session hijacking, or other impacts. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low complexity, no privileges required, but user interaction is needed. The impact includes partial confidentiality, integrity, and availability loss. No patch or official vendor advisory has been provided in the available data.

Successful exploitation of this stored XSS vulnerability can lead to execution of arbitrary scripts in the context of affected users' browsers. This may result in theft of sensitive information, session tokens, or performing actions on behalf of the user. The CVSS score of 7.1 reflects a high impact on confidentiality, integrity, and availability. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the WP OpenSearch plugin if feasible. Additionally, applying web application firewall (WAF) rules to detect and block XSS payloads may provide temporary mitigation. Monitor vendor channels for updates and apply patches promptly once released.