CVE-2025-23632: 
WordPress vulnerability analysis and mitigation

A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in Rhizome Networks CG Button plugin, tracked as CVE-2025-23632. The vulnerability was discovered by João Pedro Soares de Alcântara and publicly disclosed on March 19, 2025. This security issue affects all versions of CG Button up to version 1.0.5.6 (NVD, Wordfence).

The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). According to the CVSS 3.1 scoring system, it has received a base score of 7.1 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. This indicates that the vulnerability is network-accessible, requires low attack complexity, needs no privileges, but does require user interaction (NVD).

The vulnerability allows for Reflected Cross-Site Scripting attacks, which could potentially lead to unauthorized access to user data, session hijacking, or manipulation of web content. The CVSS scoring indicates low impacts on confidentiality, integrity, and availability, but the overall severity is rated as HIGH due to the attack's scope being changed (NVD).