What the vulnerability does
01Description
The Application Passwords plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'reject_url' parameter in all versions up to, and including, 0.1.3. This is due to insufficient input sanitization and output escaping on user supplied URLs, which allows javascript: URI schemes to be embedded in the reject_url parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when a user clicks the "No, I do not approve of this connection" button, granted they can successfully trick the victim into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
02Summary
Application Passwords contains a cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject malicious scripts. The vulnerability requires user interaction—typically clicking a crafted link—and affects versions 0.1.3 and earlier. An attacker with low privileges can inject code that executes in other users' browsers, potentially stealing session data or performing actions on their behalf.
What an attacker can do
03Attacker Capabilities
Inject malicious JavaScript that runs in other users' browsers when they visit a crafted page.
Potential impact on your site
04Site Impact
Users' sessions and data could be compromised if they interact with attacker-crafted content while logged in.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege account; victim must click a malicious link or visit an attacker-controlled page.
Key dates
06Disclosure timeline
December 6, 2025
CVE published
April 8, 2026
Record updated
