CVE-2025-22595
Published: 09 January 2025
Summary
CVE-2025-22595 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-22595 is an Improper Neutralization of Input During Web Page Generation vulnerability, manifesting as a Reflected Cross-site Scripting (XSS) issue under CWE-79. It affects the Mailing Group Listserv WordPress plugin (wp-mailing-group) developed by Yamna Khawaja, impacting all versions from n/a through 2.0.9 inclusive. The vulnerability was published on 2025-01-09.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, and user interaction such as clicking a malicious link. Remote attackers can exploit it by crafting inputs that are reflected unsanitized in web pages, executing arbitrary scripts in the context of a victim's browser. This enables low-impact theft of sensitive data like session cookies, minor data manipulation, or limited denial of service, with scope changes allowing cross-origin influence.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp-mailing-group/vulnerability/wordpress-mailing-group-listserv-plugin-2-0-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve documents the Reflected XSS vulnerability specifically in the Mailing Group Listserv plugin up to version 2.0.9. Mitigation involves updating to a non-vulnerable version if available or removing the plugin from affected WordPress sites.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2870
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yamna Khawaja Mailing Group Listserv wp-mailing-group allows Reflected XSS.This issue affects Mailing Group Listserv: from n/a through <= 2.0.9.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables T1190 exploitation and arbitrary JavaScript execution in browser via T1059.007.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses improper neutralization of input by requiring validation of information inputs to block malicious scripts in reflected XSS attacks.
Prevents reflected XSS by filtering outputs to ensure user inputs are properly encoded and cannot execute arbitrary scripts in victims' browsers.
Mandates timely identification, reporting, and correction of flaws such as this XSS vulnerability in the wp-mailing-group WordPress plugin via patching or removal.