CVE-2025-0809
Published: 31 January 2025
Summary
CVE-2025-0809 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 29.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-0809 is a stored cross-site scripting (XSS) vulnerability in the Link Fixer plugin for WordPress, affecting all versions up to and including 3.4. The issue arises from insufficient input sanitization and output escaping when handling broken links, enabling the injection of arbitrary web scripts into pages. Published on 2025-01-31, it carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and is classified under CWE-79.
Unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and no user interaction or privileges required. By injecting malicious scripts via broken links, attackers can store XSS payloads in pages that execute whenever any user, including administrators, accesses those pages, potentially compromising session data or performing actions on behalf of victims.
Mitigation details are available in advisories such as the Wordfence threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/37198f2f-2b45-40d3-b4ae-aa94213996bd?source=cve and the plugin's WordPress page at https://wordpress.org/plugins/permalink-finder/. WordPress site administrators should update the Link Fixer plugin to a version beyond 3.4 to address the vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1880
Vulnerability details
The Link Fixer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via broken links in all versions up to, and including, 3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject…
more
arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public-facing WordPress plugin directly enables T1190 exploitation and T1185 session hijacking via injected scripts.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validating information inputs, directly addressing the insufficient input sanitization that allows storage of malicious XSS payloads via broken links.
SI-15 mandates filtering information prior to output to web pages, comprehensively mitigating the lack of output escaping that enables execution of injected scripts when pages are accessed.
SI-2 ensures timely identification, reporting, and correction of system flaws, directly enabling patching of the vulnerable Link Fixer plugin versions up to 3.4.