CVE-2025-1401
Published: 13 March 2025
Summary
CVE-2025-1401 is a high-severity Cross-site Scripting (CWE-79) vulnerability in S-A Wp Click Info. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 25.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-1401 is a reflected cross-site scripting (XSS) vulnerability, classified under CWE-79, affecting the WP Click Info WordPress plugin in versions through 2.7.4. The plugin fails to sanitize and escape a parameter before outputting it back in the page, enabling attackers to inject and execute arbitrary scripts in users' browsers.
The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, and user interaction such as clicking a malicious link. Attackers can exploit it by tricking high-privilege users, such as administrators, into interacting with crafted payloads, potentially leading to theft of session cookies, account takeover, or other browser-based attacks within the changed security scope.
Mitigation details are available in the WPScan advisory at https://wpscan.com/vulnerability/072620a2-76db-49d2-aae5-1170c409f7e7/.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6446
Vulnerability details
The WP Click Info WordPress plugin through 2.7.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS enables arbitrary JavaScript execution in browser (T1059.007) and facilitates session cookie theft for hijacking (T1185).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-15 mandates filtering of output to prevent execution of injected scripts, directly addressing the failure to escape parameters before page output in this reflected XSS vulnerability.
SI-10 requires validation and sanitization of inputs, mitigating the unsanitized parameter handling that enables script injection in this CVE.
SI-2 ensures timely identification, reporting, and correction of flaws like this plugin vulnerability through patching or updates.