CVE-2025-22539
Published: 09 January 2025
Summary
CVE-2025-22539 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-22539 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-Site Scripting (XSS) under CWE-79, affecting the ka2 Custom DataBase Tables WordPress plugin (custom-database-tables). This issue impacts all versions from n/a through 2.1.34. The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to network accessibility, low attack complexity, no required privileges, user interaction, and changed scope with low impacts on confidentiality, integrity, and availability.
Attackers can exploit this Reflected XSS vulnerability remotely over the network without authentication by tricking authenticated users into interacting with maliciously crafted links or inputs that reflect executable scripts on the affected WordPress site. Successful exploitation allows attackers to execute arbitrary scripts in the victim's browser context, potentially leading to session hijacking, theft of sensitive data such as cookies or credentials, or further site compromise within the browser's scope, though impacts remain low per the CVSS metrics.
The Patchstack advisory at the provided reference details the vulnerability in the Custom DataBase Tables plugin version 2.1.34 and recommends updating to a patched version beyond 2.1.34 to mitigate the issue, as no workaround is specified in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2817
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ka2 Custom DataBase Tables custom-database-tables allows Reflected XSS.This issue affects Custom DataBase Tables: from n/a through <= 2.1.34.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables remote exploitation of an internet-facing application without authentication.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates reflected XSS by filtering information outputs during web page generation to neutralize malicious scripts.
Prevents exploitation by validating user inputs to block malicious payloads before they are reflected in web pages.
Addresses the specific flaw in the Custom DataBase Tables plugin through timely identification, reporting, and patching.