CVE-2025-22709
Published: 21 January 2025
Summary
CVE-2025-22709 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely identification, reporting, and correction of the specific reflected XSS flaw in Verge3D versions through 4.8.0.
Mandates validation of inputs to the Verge3D plugin to block malicious scripts from being reflected in web page generation.
Enforces filtering of outputs generated by the Verge3D plugin to neutralize injected scripts and prevent XSS execution.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The reflected XSS vulnerability in a public-facing WordPress plugin directly enables exploitation via T1190 Exploit Public-Facing Application and facilitates arbitrary JavaScript execution in the victim's browser context via T1059.007 JavaScript.
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soft8Soft LLC Verge3D verge3d allows Reflected XSS.This issue affects Verge3D: from n/a through <= 4.8.0.
Deeper analysisAI
CVE-2025-22709 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, affecting the Soft8Soft LLC Verge3D (verge3d) WordPress plugin. The issue impacts all versions from n/a through 4.8.0, as documented in the CVE published on 2025-01-21.
With a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the vulnerability can be exploited remotely over the network by unauthenticated attackers requiring low complexity and user interaction, such as clicking a malicious link. Exploitation changes the scope, enabling limited impacts on confidentiality, integrity, and availability, typically allowing attackers to inject and execute arbitrary scripts in the context of a victim's browser.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/verge3d/vulnerability/wordpress-verge3d-publishing-and-e-commerce-plugin-4-8-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve details the reflected XSS in the WordPress Verge3D Publishing and E-Commerce plugin version 4.8.0, providing further guidance for practitioners on assessment and response.
Details
- CWE(s)