The Flourish Pixel FP RSS Category Excluder plugin (version 1.0.0 and earlier) contains a reflected cross-site scripting vulnerability due to improper input neutralization during web page generation. This vulnerability (CVE-2025-23679) allows attackers to inject malicious scripts that execute in the context of the victim's browser, potentially leading to partial compromise of confidentiality, integrity, and availability. The CVSS v3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, leading to partial loss of confidentiality, integrity, and availability. This may enable actions such as session hijacking, defacement, or other malicious activities within the scope of the vulnerable plugin's functionality. However, no known exploits in the wild have been reported so far.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the vendor's advisory channels for updates and apply any official patches or updates once released. Until then, consider limiting exposure by restricting access or disabling the plugin if feasible.