What is the CVSS score of CVE-2025-23744?

CVE-2025-23744 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Random Posts, Mp3 Player + ShareButton are affected by CVE-2025-23744?

The Random Posts, Mp3 Player + ShareButton WordPress plugin (versions through 1.4.1) contains a reflected XSS vulnerability that could allow attackers to inject malicious scripts into victim…

How to fix or mitigate CVE-2025-23744?

Within 24 hours: Identify all WordPress installations using Random Posts, Mp3 Player + ShareButton plugin and document current versions via wp-cli or admin dashboard scan. Within 7 days: Disable or remove the plugin from all WordPress sites; if functionality is critical, isolate affected sites behind WAF rules blocking reflected XSS patterns in query parameters. Within 30 days: Monitor Patchstack and plugin vendor channels for patch availability (current status: no vendor-released patch identified); evaluate alternative plugins with active security maintenance and conduct security code review of any custom replacements.

Random Posts, Mp3 Player + ShareButton CVE-2025-23744

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-03-15 audit@patchstack.com

XSS

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Updated

Apr 25, 2026 - 00:33 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 18:31 vuln.today

CVE Published

Mar 15, 2025 - 22:15 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dvs11 Random Posts, Mp3 Player + ShareButton allows Reflected XSS. This issue affects Random Posts, Mp3 Player + ShareButton: from n/a through 1.4.1.

AnalysisAI

Reflected cross-site scripting (XSS) in Random Posts, Mp3 Player + ShareButton WordPress plugin through version 1.4.1 allows remote attackers to inject malicious scripts that execute in victim browsers with changed security context (scope change indicated in CVSS). Discovered by Patchstack security audit team. EPSS score of 0.08% (23rd percentile) indicates low current exploitation probability in the wild, and no active exploitation confirmed by CISA KEV. No public exploit code identified at time of analysis, though XSS vulnerabilities typically have low weaponization barriers.

Technical ContextAI

This is a reflected XSS vulnerability (CWE-79) in a WordPress plugin that combines random post display, MP3 playback, and social sharing functionality. The flaw stems from improper neutralization of user-supplied input during HTML generation, allowing attackers to inject arbitrary JavaScript or HTML. The CVSS scope change (S:C) from Unchanged to Changed indicates the vulnerability can affect resources beyond the plugin's own security scope, meaning injected scripts execute in the victim's WordPress session context with access to cookies, session tokens, and other site data. Reflected XSS requires the payload to be delivered via crafted URL or form submission rather than being persistently stored in the database, distinguishing it from stored XSS variants.

Affected ProductsAI

The vulnerability affects dvs11 Random Posts, Mp3 Player + ShareButton WordPress plugin versions from initial release through version 1.4.1 inclusive. All installations running version 1.4.1 or earlier are vulnerable regardless of WordPress core version or server configuration. The plugin provides functionality for displaying random posts, embedding MP3 audio players, and adding social media share buttons to WordPress sites. Vendor details and specific CPE identifiers were not provided in available data sources. Patchstack advisory available at https://patchstack.com/database/wordpress/plugin/random-posts-mp3-player-sharebutton/vulnerability/wordpress-random-posts-mp3-player-sharebutton-plugin-1-4-1-reflected-cross-site-scripting-xss-vulnerability.

RemediationAI

Primary remediation requires updating to a patched version newer than 1.4.1, though the exact fixed version number is not confirmed in available data sources. Check the WordPress plugin repository or contact plugin author dvs11 for the latest security-patched release. As interim mitigation if no patch is available or immediate update is not feasible, implement Web Application Firewall (WAF) rules to filter XSS patterns in GET/POST parameters specific to this plugin's endpoints, though this may interfere with legitimate plugin functionality involving special characters. Consider temporarily deactivating the plugin if random posts, MP3 player, and share button features are non-critical to site operations - this eliminates the attack surface entirely but removes all plugin functionality. Restrict WordPress admin access to trusted IP addresses and enforce multi-factor authentication to limit impact if XSS successfully targets administrator sessions. Review Patchstack advisory for additional details at https://patchstack.com/database/wordpress/plugin/random-posts-mp3-player-sharebutton/vulnerability/wordpress-random-posts-mp3-player-sharebutton-plugin-1-4-1-reflected-cross-site-scripting-xss-vulnerability. Note that WAF-based mitigation may generate false positives on legitimate user input containing HTML-like syntax.