PT-2025-4557 · Unknown · Post/Page Reactions

João Pedro S Alcântara · Published 2025-01-13 · Updated 2025-01-13 · CVE-2025-22568

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

The vulnerable software is Post And Page Reactions, developed by Paramveer Singh for Arete IT Private Limited. The vulnerability is an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS), which allows Reflected XSS. This issue affects Post And Page Reactions versions from n/a through 1.0.5. The vulnerability has been assigned a CVE identifier: CVE-2025-22568. There is a public reference to the vulnerability, but it is not clear if there is a public exploit or if the vulnerability has been exploited by attackers. The vulnerability can be exploited by injecting malicious input during web page generation, allowing an attacker to perform Reflected XSS attacks. #PostAndPageReactions #CrossSiteScripting #XSS #CVE202522568 #ReflectedXSS #AreteITPrivateLimited #ParamveerSingh #ImproperNeutralizationOfInput #WebPageGenerationVulnerability

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-22568

Affected Products

Post/Page Reactions

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-22568 · Security Note
• https://twitter.com/VulmonFeeds/status/1878870493287047329 · Twitter Post
• https://t.me/cvedetector/15144 · Telegram Post
• https://twitter.com/CVEnew/status/1878799444893720898 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/post-and-page-reactions/vulnerability/wordpress-post-and-page-reactions-plugin-1-0-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/wordpress/plugin/post-and-page-reactions/vulnerability/wordpress-post-and-page-reactions-plugin-1-0-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note