CVE-2025-23478
Published: 03 March 2025
Summary
CVE-2025-23478 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-15 requires filtering of information outputs to neutralize malicious scripts before rendering, directly preventing reflected XSS exploitation in the WordPress plugin.
SI-10 enforces validation of user inputs, addressing the improper neutralization that allows crafted inputs to be reflected as executable scripts.
SI-2 mandates timely flaw remediation, including patching the specific vulnerability in Photo Video Store versions through 21.07.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables web app exploitation (T1190) for client-side script execution (T1203), facilitating keylogging (T1056.001) and web session cookie theft (T1539) as described.
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmsaccount Photo Video Store photo-video-store allows Reflected XSS.This issue affects Photo Video Store: from n/a through <= 21.07.
Deeper analysisAI
CVE-2025-23478 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, affecting the cmsaccount Photo Video Store WordPress plugin (photo-video-store). The issue impacts all versions from n/a through 21.07 and was published on 2025-03-03. It carries a CVSS v3.1 base score of 7.1, reflecting network accessibility, low attack complexity, no required privileges, user interaction, changed scope, and low impacts to confidentiality, integrity, and availability.
Remote attackers require no authentication (PR:N) and can exploit the vulnerability by crafting malicious inputs that are reflected back in web page generation, tricking users into clicking links or visiting pages (UI:R). Exploitation executes arbitrary scripts in the victim's browser context (S:C), enabling theft of session cookies, keystroke logging, or minor defacement, with limited overall impact due to the low confidentiality, integrity, and availability ratings.
Mitigation details are available in advisories such as the Patchstack database entry at https://patchstack.com/database/Wordpress/Plugin/photo-video-store/vulnerability/wordpress-photo-video-store-plugin-21-07-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve, which documents the Reflected XSS in the WordPress Photo Video Store plugin version 21.07.
Details
- CWE(s)