CVE-2025-22583
Published: 13 January 2025
Summary
CVE-2025-22583 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-22583 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Reflected Cross-site Scripting (XSS) as classified under CWE-79. It affects the WordPress plugin Scan External Links developed by anshulsojatia, with the issue present in all versions from n/a through 1.0 inclusive. Published on 2025-01-13T14:15:12.300, the vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Unauthenticated attackers accessible over the network can exploit this vulnerability with low attack complexity by tricking users into interacting with malicious input, such as clicking a crafted link. Successful exploitation allows execution of arbitrary JavaScript in the context of the victim's browser, potentially compromising low levels of confidentiality, integrity, and availability due to the changed scope.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/scan-external-links/vulnerability/wordpress-scan-external-links-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2858
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anshulsojatia Scan External Links scan-external-links allows Reflected XSS.This issue affects Scan External Links: from n/a through <= 1.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables exploitation of the web application (T1190) and arbitrary JavaScript execution in the victim browser (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses improper neutralization of input during web page generation by requiring output filtering to encode reflected user input and prevent XSS execution.
Requires validation of untrusted inputs to the WordPress plugin, rejecting or sanitizing malicious payloads that could lead to reflected XSS.
Ensures timely identification, reporting, and patching of the specific flaw in Scan External Links plugin versions through 1.0 to remediate the XSS vulnerability.