The AP HoneyPot WordPress Plugin by Denis V (Artprima) contains a vulnerability identified as CVE-2025-58855, characterized by improper neutralization of formula elements in CSV files. This weakness enables reflected cross-site scripting (XSS) attacks, potentially allowing attackers to execute arbitrary scripts in the context of the victim's browser. The issue affects versions up to and including 1.4. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to perform reflected XSS attacks, potentially leading to unauthorized actions or data exposure in the context of a user's session. The CVSS vector indicates impacts on confidentiality, integrity, and availability, though no active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when handling CSV files generated or processed by the AP HoneyPot plugin and consider disabling or removing the plugin if feasible.