CVE-2025-22635
Published: 23 February 2025
Summary
CVE-2025-22635 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Imithemes Eventer. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-22635 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-Site Scripting (XSS) under CWE-79, affecting the Eventer WordPress plugin developed by imithemes. The issue impacts all versions of Eventer from n/a through those prior to 3.9.9. Published on 2025-02-23, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to network accessibility, low attack complexity, no required privileges, user interaction, and scope change with low impacts on confidentiality, integrity, and availability.
Attackers can exploit this vulnerability remotely without authentication by crafting malicious input that is reflected in dynamically generated web pages, tricking users into interacting with it, such as clicking a specially crafted link. Successful exploitation allows attackers to execute arbitrary scripts in the context of the victim's browser, potentially leading to low-level theft of sensitive data, minor modifications to page content or behavior, and limited denial of service, with the scope change enabling impacts across security boundaries.
Patchstack's advisory on the vulnerability recommends updating the Eventer WordPress Event Booking Manager plugin to version 3.9.9 or later, where the reflected XSS issue has been addressed. Security practitioners should verify plugin versions on affected WordPress sites and apply the patch promptly, while also implementing general XSS defenses like Content Security Policy where possible.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4395
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imithemes Eventer eventer allows Reflected XSS.This issue affects Eventer: from n/a through < 3.9.9.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The reflected XSS vulnerability in a public-facing WordPress plugin directly enables exploitation of web applications via crafted malicious input (T1190) and allows arbitrary JavaScript execution in the victim's browser context (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-15 directly and comprehensively prevents reflected XSS by requiring filtering of information output to neutralize malicious scripts reflected in dynamically generated web pages.
SI-10 prevents reflected XSS by validating untrusted inputs to block malicious payloads before they can be reflected in web page generation.
SI-2 mitigates this specific plugin flaw by requiring identification, reporting, and timely patching to version 3.9.9 or later.