CVE-2020-25033: 
WordPress vulnerability analysis and mitigation

The Blubrry subscribe-sidebar (aka Subscribe Sidebar) plugin version 1.3.1 for WordPress contains a reflected Cross-Site Scripting (XSS) vulnerability, identified as CVE-2020-25033. The vulnerability was discovered and disclosed in June 2020, leading to the plugin being closed on June 23, 2020. The vulnerability affects the subscribe_sidebar.php file through the status parameter (WordPress Plugin, NVD).

The vulnerability is classified as a CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) issue. According to the CVSS 3.1 scoring system, it has received a base score of 6.1 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. Under CVSS 2.0, it scores 4.3 (MEDIUM) with the vector (AV:N/AC:M/Au:N/C:N/I:P/A:N) (NVD).

The vulnerability allows attackers to perform reflected cross-site scripting attacks through the status parameter in subscribe_sidebar.php. This could potentially lead to the execution of malicious scripts in users' browsers within the context of the affected website, potentially compromising user data or session information (NVD).

The vulnerability requires no authentication (Au:N) and can be exploited remotely (AV:N), though it does require user interaction (UI:R) to be successful. The attack complexity is considered low (AC:L), making it relatively straightforward to exploit (NVD).

As a response to the security issue, the plugin was closed and removed from the WordPress plugin directory on June 23, 2020. Users are advised to uninstall the vulnerable plugin from their WordPress installations as no patch was released (WordPress Plugin).