Cyber Resilience

CVE-2025-22501

High

Published: 28 March 2025

Published
28 March 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0016 36.2th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-22501 is a high-severity Basic XSS (CWE-80) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 36.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2025-22501 is an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability, classified as CWE-80, in the Improve My City WordPress plugin (improve-my-city). This reflected XSS issue affects all versions of the plugin from n/a through 1.6.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). An unauthenticated attacker accessible over the network can exploit it with low complexity by tricking a user into performing an action, such as visiting a malicious link, which reflects attacker-controlled input containing script elements. Exploitation changes the scope and results in low impacts to confidentiality, integrity, and availability in the victim's browser context.

Patchstack provides details on this vulnerability in their advisory at https://patchstack.com/database/Wordpress/Plugin/improve-my-city/vulnerability/wordpress-improve-my-city-plugin-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve, which security practitioners should consult for mitigation guidance and patch information.

EU & UK References

Vulnerability details

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Improve My City Improve My City improve-my-city allows Reflected XSS.This issue affects Improve My City: from n/a through <= 1.6.

CWE(s)
CWE-80

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
attack.mitre.org →
T1566.002 Spearphishing Link Initial Access
Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.
attack.mitre.org →
Why these techniques?

Reflected XSS enables arbitrary JavaScript execution in the victim's browser via a crafted malicious link.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-14835Shared CWE-80
CVE-2024-39363Shared CWE-80
CVE-2026-6002Shared CWE-80
CVE-2024-46910Shared CWE-80
CVE-2024-13704Shared CWE-80
CVE-2026-40873Shared CWE-80
CVE-2025-24680Shared CWE-80
CVE-2025-53835Shared CWE-80
CVE-2026-32891Shared CWE-80
CVE-2026-33080Shared CWE-80

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-15 Information Output Filtering good match
prevent

Directly prevents reflected XSS by filtering and encoding script-related HTML tags in web page outputs before rendering in the victim's browser.

SI-10 Information Input Validation good match
prevent

Validates and sanitizes attacker-controlled inputs reflected in web responses to block script elements from being processed.

SI-2 Flaw Remediation good match
preventdetect

Identifies and remediates the specific improper neutralization flaw in the Improve My City plugin through vulnerability scanning and patching.

References