Cyber Resilience

CVE-2025-22763

High

Published: 21 January 2025

Published
21 January 2025
Modified
28 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0013 31.8th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-22763 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Brizy Brizy. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2025-22763 is an improper neutralization of input during web page generation vulnerability, classified as reflected cross-site scripting (XSS) under CWE-79, affecting the Brizy Pro WordPress plugin. Published on 2025-01-21, this issue impacts Brizy Pro versions from n/a through 2.6.1, with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity, though it requires user interaction, such as visiting a maliciously crafted URL. Exploitation changes the scope and enables limited impacts on confidentiality, integrity, and availability, allowing arbitrary JavaScript execution in the victim's browser context.

The Patchstack advisory provides further details on this vulnerability at https://patchstack.com/database/wordpress/plugin/brizy-pro/vulnerability/wordpress-brizy-pro-plugin-2-6-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.

EU & UK References

Vulnerability details

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Brizy Pro allows Reflected XSS. This issue affects Brizy Pro: from n/a through 2.6.1.

CWE(s)
CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
attack.mitre.org →
Why these techniques?

Reflected XSS in public-facing WordPress plugin enables exploitation of the application (T1190) and arbitrary JavaScript execution in browser (T1059.007).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-10960Same product: Brizy Brizy
CVE-2026-3231Shared CWE-79
CVE-2025-23481Shared CWE-79
CVE-2025-69302Shared CWE-79
CVE-2025-23734Shared CWE-79
CVE-2025-23571Shared CWE-79
CVE-2025-65110Shared CWE-79
CVE-2026-24948Shared CWE-79
CVE-2025-27352Shared CWE-79
CVE-2025-30349Shared CWE-79

Affected Assets

brizy
brizy
≤ 2.6.1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-15 Information Output Filtering good match
prevent

SI-15 requires filtering of information outputs, directly preventing reflected XSS by neutralizing untrusted input during web page generation.

SI-10 Information Input Validation good match
prevent

SI-10 mandates validation of information inputs, addressing the improper neutralization of input that enables arbitrary JavaScript execution in the Brizy Pro plugin.

SI-2 Flaw Remediation good match
prevent

SI-2 ensures timely flaw remediation, mitigating this specific CVE by patching the vulnerable Brizy Pro versions up to 2.6.1.

References