CVE-2025-22501
Published: 28 March 2025
Summary
CVE-2025-22501 is a high-severity Basic XSS (CWE-80) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 36.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents reflected XSS by filtering and encoding script-related HTML tags in web page outputs before rendering in the victim's browser.
Validates and sanitizes attacker-controlled inputs reflected in web responses to block script elements from being processed.
Identifies and remediates the specific improper neutralization flaw in the Improve My City plugin through vulnerability scanning and patching.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS enables arbitrary JavaScript execution in the victim's browser via a crafted malicious link.
NVD Description
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Improve My City Improve My City improve-my-city allows Reflected XSS.This issue affects Improve My City: from n/a through <= 1.6.
Deeper analysisAI
CVE-2025-22501 is an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability, classified as CWE-80, in the Improve My City WordPress plugin (improve-my-city). This reflected XSS issue affects all versions of the plugin from n/a through 1.6.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). An unauthenticated attacker accessible over the network can exploit it with low complexity by tricking a user into performing an action, such as visiting a malicious link, which reflects attacker-controlled input containing script elements. Exploitation changes the scope and results in low impacts to confidentiality, integrity, and availability in the victim's browser context.
Patchstack provides details on this vulnerability in their advisory at https://patchstack.com/database/Wordpress/Plugin/improve-my-city/vulnerability/wordpress-improve-my-city-plugin-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve, which security practitioners should consult for mitigation guidance and patch information.
Details
- CWE(s)