CVE-2025-22754

High

Published: 15 January 2025

Published

15 January 2025

Modified

29 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS Score 0.0013 31.5th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-22754 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Spearphishing Link (T1566.002); ranked at the 31.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2025-22754 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Berkman Klein Center Amber amberlink WordPress plugin. This issue affects Amber versions from n/a through 1.4.4.

The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating exploitation over the network with low complexity, no required privileges, and user interaction. An unauthenticated remote attacker can deliver a malicious payload via a crafted request, tricking a victim into interacting with it, such as clicking a link, to execute arbitrary scripts in the browser context of the targeted user.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/amberlink/vulnerability/wordpress-amber-plugin-1-4-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve documents this reflected XSS vulnerability in the WordPress Amber plugin up to version 1.4.4 and provides details for mitigation.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-2969

Vulnerability details

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Berkman Klein Center Amber amberlink allows Reflected XSS.This issue affects Amber: from n/a through <= 1.4.4.

CWE(s): CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1566.002 Spearphishing Link Initial Access

Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.

attack.mitre.org →

T1185 Browser Session Hijacking Collection

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.

attack.mitre.org →

Why these techniques?

The reflected XSS allows crafting malicious links to deliver and execute arbitrary scripts in the victim's browser upon click, directly facilitating spearphishing links (T1566.002) and enabling browser session hijacking via script injection (T1185).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1