CVE-2025-22341
Published: 31 January 2025
Summary
CVE-2025-22341 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-15 (Information Output Filtering) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Remediates the specific reflected XSS flaw in the Hide Login+ WordPress plugin by identifying, patching, and testing to prevent exploitation.
Filters malicious scripts from information output during web page generation, directly neutralizing reflected XSS payloads before browser execution.
Validates and sanitizes user input at entry points to restrict malicious payloads that could be improperly reflected as XSS in web pages.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables exploitation of public-facing apps (T1190) via phishing links (T1566.002) that require user interaction with malicious links (T1204.001) to execute scripts in browser context.
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in parswp Hide Login+ hide-login allows Reflected XSS.This issue affects Hide Login+: from n/a through <= 3.5.1.
Deeper analysisAI
CVE-2025-22341 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Hide Login+ (hide-login) WordPress plugin by parswp. This issue affects all versions of the plugin up to and including 3.5.1.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating it is exploitable over the network with low attack complexity, no required privileges, but necessitating user interaction. Remote attackers can exploit it by tricking authenticated or unauthenticated users—such as site administrators or visitors—into interacting with maliciously crafted input reflected in web pages, such as via a phishing link. Successful exploitation enables limited impacts on confidentiality, integrity, and availability within a changed scope, potentially allowing script execution in the victim's browser context.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/hide-login/vulnerability/wordpress-hide-login-plugin-3-5-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve documents this Reflected XSS vulnerability specifically in Hide Login+ version 3.5.1 and provides further technical details for mitigation.
Details
- CWE(s)