The vulnerability CVE-2025-23792 involves improper neutralization of input in the Passwordless WP plugin by WP Busters, resulting in a reflected cross-site scripting (XSS) flaw. This allows an attacker to craft malicious input that is reflected in web pages without proper sanitization, potentially enabling script execution in users' browsers. The affected versions are up to 1.1.6. The CVSS v3.1 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. There is no vendor advisory or patch link provided, so patch status is not confirmed.

Successful exploitation of this reflected XSS vulnerability can allow attackers to execute arbitrary scripts in the context of affected users' browsers. This may lead to partial disclosure of sensitive information, modification of data, or disruption of service availability. The CVSS vector indicates that the attack can be performed remotely without privileges but requires user interaction. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted input on affected versions of the Passwordless WP plugin. Monitoring vendor channels for updates is recommended.