CVE-2025-22754
Published: 15 January 2025
Summary
CVE-2025-22754 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Spearphishing Link (T1566.002); ranked at the 25.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-15 requires output filtering for web page generation, directly neutralizing malicious scripts in reflected XSS payloads before browser execution.
SI-10 enforces validation of information inputs to the WordPress plugin, preventing malicious payloads from being accepted and reflected.
SI-2 mandates identification and remediation of flaws like this specific XSS vulnerability in Amber plugin versions up to 1.4.4.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The reflected XSS allows crafting malicious links to deliver and execute arbitrary scripts in the victim's browser upon click, directly facilitating spearphishing links (T1566.002) and enabling browser session hijacking via script injection (T1185).
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Berkman Klein Center Amber amberlink allows Reflected XSS.This issue affects Amber: from n/a through <= 1.4.4.
Deeper analysisAI
CVE-2025-22754 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Berkman Klein Center Amber amberlink WordPress plugin. This issue affects Amber versions from n/a through 1.4.4.
The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating exploitation over the network with low complexity, no required privileges, and user interaction. An unauthenticated remote attacker can deliver a malicious payload via a crafted request, tricking a victim into interacting with it, such as clicking a link, to execute arbitrary scripts in the browser context of the targeted user.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/amberlink/vulnerability/wordpress-amber-plugin-1-4-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve documents this reflected XSS vulnerability in the WordPress Amber plugin up to version 1.4.4 and provides details for mitigation.
Details
- CWE(s)