CVE-2025-22751
Published: 15 January 2025
Summary
CVE-2025-22751 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-22751 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, affecting the farinspace Partners WordPress plugin. This issue impacts all versions from an unspecified initial release through 0.2.0, as published on 2025-01-15.
The vulnerability carries a CVSS v3.1 base score of 7.1 (High) with the vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. Remote attackers require no privileges and can exploit it over the network with low attack complexity, though user interaction is needed, such as clicking a malicious link. Exploitation enables reflected XSS, potentially allowing limited impacts on confidentiality, integrity, and availability, with a changed scope that could facilitate cross-origin actions like session hijacking or script injection in the victim's browser context.
Mitigation details are provided in advisories including the Patchstack database entry at https://patchstack.com/database/Wordpress/Plugin/partners/vulnerability/wordpress-partners-plugin-0-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2966
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in farinspace Partners partners allows Reflected XSS.This issue affects Partners: from n/a through <= 0.2.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables T1190 Exploit Public-Facing Application; facilitates T1185 Browser Session Hijacking via script injection and session hijacking in victim browser context.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-15 requires filtering of information outputs to neutralize potentially malicious input like scripts during web page generation, directly preventing reflected XSS exploitation.
SI-10 enforces validation of user inputs at entry points, blocking malicious payloads from being accepted and reflected in web responses.
SI-2 mandates identification and timely remediation of flaws, such as patching the vulnerable farinspace Partners WordPress plugin to fix the XSS issue.