The vulnerability CVE-2025-23881 affects the littlejon LJ Custom Menu Links plugin (versions ≤ 2.5) and is classified as a reflected cross-site scripting (XSS) flaw. It results from improper input sanitization during web page generation, enabling attackers to inject and execute arbitrary scripts in users' browsers. The CVSS 3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this reflected XSS vulnerability could allow attackers to execute arbitrary scripts in the context of the victim's browser session, potentially leading to partial disclosure of sensitive information, modification of web content, or disruption of service. The CVSS vector indicates impacts on confidentiality, integrity, and availability, but no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or limiting use of the LJ Custom Menu Links plugin to reduce exposure. Monitor vendor communications for updates and apply patches promptly once released.