CVE-2025-22680
Published: 16 February 2025
Summary
CVE-2025-22680 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Information output filtering directly prevents reflected XSS by neutralizing untrusted input reflected in web page generation, addressing the core improper neutralization flaw in Ad Inserter Pro.
Information input validation blocks malicious payloads in user-supplied inputs tricked via crafted links, stopping the injection of executable scripts before reflection.
Flaw remediation requires updating the vulnerable Ad Inserter Pro plugin beyond version 2.7.39, eliminating the specific XSS vulnerability as recommended by Patchstack.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin enables remote exploitation of web application (T1190) via crafted malicious links requiring user interaction (T1204.001).
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Ad Inserter Pro allows Reflected XSS. This issue affects Ad Inserter Pro: from n/a through 2.7.39.
Deeper analysisAI
CVE-2025-22680 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Reflected Cross-site Scripting (XSS) as classified under CWE-79. It affects the Ad Inserter Pro WordPress plugin, specifically versions from n/a through 2.7.39. Published on 2025-02-16, the issue carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to network accessibility, low complexity, no required privileges, user interaction, and changed scope with low impacts on confidentiality, integrity, and availability.
Attackers can exploit this vulnerability remotely without authentication by tricking users into interacting with maliciously crafted links or inputs that reflect executable scripts back in the browser. No special privileges are needed, making it accessible to any unauthenticated adversary on the network. Successful exploitation allows injection of arbitrary JavaScript, potentially leading to session hijacking, data theft, or further site compromise within the victim's browser context, though impacts remain low per the CVSS metrics.
The Patchstack advisory (https://patchstack.com/database/wordpress/plugin/ad-inserter-pro/vulnerability/wordpress-ad-inserter-pro-plugin-2-7-39-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve) details the vulnerability in Ad Inserter Pro version 2.7.39, recommending mitigation through updating to a patched version beyond 2.7.39.
Details
- CWE(s)