CVE-2025-22711
Published: 21 January 2025
Summary
CVE-2025-22711 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 33.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the CVE by requiring timely patching of the vulnerable WordPress plugin Image Source Control to versions beyond 2.29.0.
Prevents reflected XSS by filtering and encoding information outputs prior to rendering in web pages, neutralizing malicious scripts.
Addresses improper input neutralization by validating all user inputs to the plugin, blocking malicious payloads before processing.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS enables arbitrary JavaScript execution in the victim's browser when triggered by a crafted malicious link, directly mapping to JavaScript scripting interpreter and user execution of malicious link.
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thomas Maier Image Source Control image-source-control-isc allows Reflected XSS.This issue affects Image Source Control: from n/a through <= 2.29.0.
Deeper analysisAI
CVE-2025-22711 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Reflected Cross-site Scripting (XSS), in the WordPress plugin Image Source Control (image-source-control-isc) by Thomas Maier. The issue affects all versions of the plugin from n/a through 2.29.0 and is classified under CWE-79.
With a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the vulnerability is exploitable over the network by unauthenticated attackers with low attack complexity, though it requires user interaction such as clicking a malicious link. Exploitation changes the scope and allows limited impacts on confidentiality, integrity, and availability, potentially enabling attackers to execute arbitrary scripts in the context of a victim's browser.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/image-source-control-isc/vulnerability/wordpress-image-source-control-lite-plugin-2-29-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve documents the Reflected XSS vulnerability in Image Source Control version 2.29.0 and provides details on mitigation, which includes updating the plugin beyond the affected versions.
Details
- CWE(s)