CVE-2025-23437
Published: 03 March 2025
Summary
CVE-2025-23437 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 45.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-15 directly prevents reflected XSS by requiring filtering and neutralization of malicious inputs during web page generation to block script execution in the victim's browser.
SI-10 enforces validation of untrusted inputs to the WordPress plugin, addressing the improper neutralization that enables reflected XSS exploitation.
SI-2 ensures timely remediation of the specific flaw in ntp-header-images versions <=1.2 through patching, eliminating the XSS vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS allows arbitrary script execution in victim's browser via crafted URL, directly enabling client-side code execution (T1203) and facilitating delivery through malicious links (T1566.002).
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nord_tramper ntp-header-images header-images-rotator allows Reflected XSS.This issue affects ntp-header-images: from n/a through <= 1.2.
Deeper analysisAI
CVE-2025-23437 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the nord_tramper ntp-header-images header-images-rotator WordPress plugin. This issue affects versions of ntp-header-images from n/a through 1.2 inclusive. The vulnerability was published on 2025-03-03T14:15:34.890 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
The vulnerability can be exploited by remote attackers requiring no privileges or authentication. Exploitation involves tricking a user into interacting with malicious input, such as visiting a crafted URL, which causes the plugin to reflect unsanitized input during web page generation. This executes arbitrary scripts in the victim's browser context, potentially leading to low impacts on confidentiality, integrity, and availability, with a changed scope due to the cross-origin effects.
Mitigation details are available in advisories such as the Patchstack database entry at https://patchstack.com/database/Wordpress/Plugin/header-images-rotator/vulnerability/wordpress-ntp-header-images-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)