CVE-2025-1401: 
WordPress vulnerability analysis and mitigation

The WP Click Info WordPress plugin through version 2.7.4 contains a Reflected Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered by Hassan Khan Yusufzai (Splint3r7) and was publicly disclosed on February 20, 2025. This security issue affects the WordPress plugin wp-click-info, with no known fix currently available (WPScan).

The vulnerability stems from improper parameter sanitization and escaping before outputting it back in the page. This results in a Reflected Cross-Site Scripting vulnerability that could be exploited against high-privilege users such as administrators. The vulnerability has been assigned a CVSS v3.1 score of 7.1 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (NVD, WPScan).

The vulnerability can be exploited to perform cross-site scripting attacks specifically targeting high-privilege users such as administrators. This could potentially lead to unauthorized actions being performed with administrative privileges (WPScan).

Currently, there is no known fix available for this vulnerability. Users of the WP Click Info plugin should consider implementing additional security measures or temporarily disabling the plugin until a patch is released (WPScan).