CVE-2025-23550 — Reflected Cross-Site Scripting (XSS) in WordPress “Product Puller” plugin

CyberDefender 2 mins0

CVE-2025-23550 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the WordPress “Product Puller” plugin (developed by Kemal YAZICI) in versions up through 1.5.1. An XSS flaw means that unsanitized user input is improperly included in generated web pages, allowing an attacker to inject malicious script that runs in a victim’s browser.

Impact:

  • Type: Reflected XSS (Improper Neutralization of Input During Web Page Generation)
  • Severity: High
  • CVSS v3 Base Score: 7.1
  • Attack Vector: Network (remote)
  • Privileges Required: None
  • User Interaction: Required (victim must click a crafted link)
  • Scope: Changed — impacting beyond initial component
  • Impact: Potential for session hijacking, redirecting users, or executing malicious actions in the context of an authenticated user’s browser session.

Affected Software:

  • WordPress Plugin: Product Puller
  • Versions: up to 1.5.1 (no fixed version publicly indicated yet)

Mitigation & Recommendations

Until an official patch is released by the plugin maintainer, you should consider the following:

  • Update / Patch: Monitor for a security update or patched plugin version and apply it as soon as it becomes available.
  • Remove/Disable Plugin: If you’re not actively using the Product Puller plugin, remove or deactivate it on WordPress sites.
  • Hardening: Ensure Content Security Policy (CSP) or similar mitigations are in place to limit the impact of injected scripts.
  • User Awareness: Educate users not to click suspicious links, especially in admin interfaces.

CyberDefender