CVE-2025-23738: 
WordPress vulnerability analysis and mitigation

A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in NotFound Ps Ads Pro plugin affecting versions through 1.0.0. The vulnerability was identified on January 16, 2025, and assigned CVE-2025-23738. This security issue affects the WordPress plugin Ps Ads Pro and allows for Reflected XSS attacks (Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 7.1 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The vulnerability type is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). The issue requires no authentication to exploit, though user interaction is required for successful exploitation (NVD).

This vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when guests visit the affected site, potentially compromising user data and website integrity (Patchstack).

While no official fix is available, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks. Website administrators are advised to implement the virtual patch immediately to protect their sites until an official fix becomes available (Patchstack).