Executive brief
The LIVE TV WordPress plugin is used to display live television content on WordPress sites. A reflected cross-site scripting (XSS) vulnerability allows unauthenticated attackers to inject malicious scripts through specially crafted URLs, potentially stealing visitor data, hijacking user sessions, or compromising website visitors' accounts.
Technical details
This is a reflected cross-site scripting (XSS) vulnerability in the LIVE TV WordPress plugin (versions <= 1.2) caused by improper neutralization of user input during web page generation. The vulnerability is unauthenticated and network-accessible via a reflected vector, requiring user interaction (e.g., clicking a malicious link). An attacker can craft a malicious URL containing JavaScript that executes in the browser of any visitor who clicks the link, allowing credential theft, session hijacking, or malware distribution. No official patch is currently available, though mitigation rules have been issued.
Affected products
- Omar Mohamed Mohamoud LIVE TV through 1.2
Timeline
- 2025-12-31: disclosed: CVE-2025-23608 published on NVD
- 2025-03-19: advisory: Patchstack vulnerability advisory published