CVE-2025-23451
Published: 03 March 2025
Summary
CVE-2025-23451 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-23451 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Awesome Twitter Feeds WordPress plugin by titodevera. This issue affects all versions of the plugin from n/a through 1.0 inclusive. Published on 2025-03-03, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
The vulnerability can be exploited by unauthenticated attackers accessible over the network, with low attack complexity but requiring user interaction, such as visiting a maliciously crafted URL. Exploitation changes the security scope and enables limited impacts on confidentiality, integrity, and availability, allowing attackers to inject and execute arbitrary scripts in victims' browsers, potentially leading to session hijacking, data theft, or other client-side compromises typical of reflected XSS.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/awesome-twitter-feeds/vulnerability/wordpress-awesome-twitter-feeds-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve provides details on this vulnerability in Awesome Twitter Feeds version 1.0. Security practitioners should review this reference for recommended mitigations, such as plugin updates or input sanitization workarounds.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5754
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in titodevera Awesome Twitter Feeds awesome-twitter-feeds allows Reflected XSS.This issue affects Awesome Twitter Feeds: from n/a through <= 1.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables T1190 (exploiting public-facing apps for initial access via crafted URLs) and facilitates T1185 (browser session hijacking via arbitrary script execution leading to cookie theft and client-side compromises).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Information Output Filtering directly prevents reflected XSS by encoding or filtering user input prior to rendering in web pages, neutralizing script injection in the Awesome Twitter Feeds plugin.
Information Input Validation ensures malicious inputs from unauthenticated users are checked and sanitized before processing, addressing the improper neutralization flaw in the plugin.
Flaw Remediation requires timely identification, reporting, and patching of the specific XSS vulnerability in Awesome Twitter Feeds versions through 1.0.