CVE-2025-2009
Published: 26 March 2025
Summary
CVE-2025-2009 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 32.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-2009 is a stored cross-site scripting (XSS) vulnerability in the Newsletters plugin for WordPress, affecting all versions up to and including 4.9.9.7. The flaw arises in the logging functionality due to insufficient input sanitization and output escaping, allowing arbitrary web scripts to be injected into pages. It is classified under CWE-79 with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges or user interaction, and changed scope.
Unauthenticated attackers can exploit this vulnerability remotely by injecting malicious scripts through the logging mechanism. Once injected, the scripts persist in pages and execute in the context of any user who accesses those pages, potentially leading to session hijacking, data theft, or further site compromise depending on the victim's privileges.
References include Wordfence's threat intelligence advisory detailing the issue, along with WordPress plugin trac links to the vulnerable code in views/admin/settings/view_logs.php at line 107 and a subsequent changeset 3257980, which indicates a patch addressing the sanitization and escaping deficiencies. Security practitioners should update the plugin beyond version 4.9.9.7 to mitigate the risk.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8113
Vulnerability details
The Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the logging functionality in all versions up to, and including, 4.9.9.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject…
more
arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public-facing WordPress plugin directly enables T1190 (Exploit Public-Facing Application) via remote unauthenticated injection; malicious web scripts (JavaScript) facilitate T1059.007 (JavaScript) for execution leading to session hijacking or data theft.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly counters the insufficient input sanitization in the logging functionality by enforcing validation of all inputs to block arbitrary script injection.
Addresses the output escaping deficiency by filtering log data rendered in views/admin/settings/view_logs.php to neutralize injected scripts before execution.
Ensures timely remediation of the specific flaw in Newsletters plugin versions up to 4.9.9.7 through identification, reporting, and patching as indicated in changeset 3257980.