CVE-2025-22576
Published: 13 January 2025
Summary
CVE-2025-22576 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-22576 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Site PIN WordPress plugin developed by Marcus Downing. This issue affects the Site PIN plugin from unknown initial versions through version 1.3 inclusive. The vulnerability was published on 2025-01-13 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Attackers can exploit this vulnerability remotely over the network with low attack complexity and no required privileges, though it demands user interaction such as clicking a malicious link. Upon successful exploitation, adversaries achieve limited impacts on confidentiality, integrity, and availability with a changed scope, enabling actions like script injection in the victim's browser to potentially steal session cookies, redirect users, or perform other client-side attacks within the site's context.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/site-pin/vulnerability/wordpress-site-pin-plugin-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve details this Reflected XSS vulnerability in the WordPress Site PIN plugin up to version 1.3, serving as the primary reference for security practitioners to review specific mitigation guidance, such as applying available patches or hardening configurations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2851
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcus Downing Site PIN site-pin allows Reflected XSS.This issue affects Site PIN: from n/a through <= 1.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables remote exploitation of a web application (T1190); client-side script execution may support secondary actions such as cookie theft but is not a distinct Enterprise technique.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the reflected XSS vulnerability by requiring timely identification, reporting, and patching of the flaw in the Site PIN WordPress plugin up to version 1.3.
Prevents exploitation by enforcing validation of user inputs at entry points to neutralize malicious scripts before processing in the vulnerable plugin.
Addresses reflected XSS by filtering information outputs to block execution of injected scripts in the generated web pages.