CVE-2025-22706
Published: 21 January 2025
Summary
CVE-2025-22706 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 32.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-22706 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Social Pug: Author Box WordPress plugin by iova.mihai. This issue affects all versions of the plugin from n/a through 1.0.0 and was published on 2025-01-21.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating it is exploitable over the network with low attack complexity, no required privileges, but user interaction is necessary. Remote attackers can trick authenticated or unauthenticated users into interacting with malicious content, such as a crafted link, to inject and execute arbitrary scripts in the victim's browser context with changed scope, potentially leading to low-level impacts on confidentiality, integrity, and availability.
The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/social-pug-author-box/vulnerability/wordpress-social-pug-author-box-plugin-1-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve provides details on this Reflected XSS vulnerability in Social Pug: Author Box version 1.0.0, including recommended mitigations for affected WordPress installations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2932
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.mihai Social Pug: Author Box allows Reflected XSS. This issue affects Social Pug: Author Box: from n/a through 1.0.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The reflected XSS vulnerability directly enables injection and execution of arbitrary JavaScript in the victim's browser (T1059.007) and is exploited via crafted malicious links that users are tricked into interacting with (T1204.001).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the improper neutralization of input by requiring validation of user inputs to prevent injection of malicious scripts in reflected XSS attacks.
Mitigates reflected XSS by filtering and encoding information outputs during web page generation to block execution of injected scripts in the victim's browser.
Ensures timely identification, reporting, and patching of the specific flaw in the WordPress plugin to remediate the XSS vulnerability.