CVE-2025-22631
Published: 23 February 2025
Summary
CVE-2025-22631 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious Link (T1204.001); ranked at the 32.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-15 enforces output filtering and encoding of user inputs in web pages, directly preventing reflected XSS execution in the vbout Marketing Automation plugin.
SI-10 requires validation of information inputs, rejecting or sanitizing malicious payloads that enable reflected XSS in the vulnerable plugin.
SI-2 mandates timely flaw remediation, directly mitigating this CVE through patching affected Marketing Automation versions up to 1.2.6.8.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS allows crafting malicious links/requests that trick victims into triggering arbitrary script execution in browser; directly maps to malicious link delivery and spearphishing link techniques.
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vbout Marketing Automation marketing-automation allows Reflected XSS.This issue affects Marketing Automation: from n/a through <= 1.2.6.8.
Deeper analysisAI
CVE-2025-22631 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, affecting the vbout Marketing Automation plugin for WordPress. The issue impacts Marketing Automation versions from n/a through 1.2.6.8 and was published on 2025-02-23.
The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating exploitation over the network with low attack complexity, no required privileges, and user interaction. A remote unauthenticated attacker can craft a malicious request, such as a link, and trick a victim into accessing it on a vulnerable site, leading to arbitrary script execution in the victim's browser context and potential low-level impacts on confidentiality, integrity, and availability with changed scope.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/marketing-automation/vulnerability/wordpress-marketing-automation-plugin-1-2-6-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)