CVE-2025-23489
Published: 21 January 2025
Summary
CVE-2025-23489 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 38.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-15 (Information Output Filtering) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 requires identification, reporting, and correction of system flaws, directly addressing this reflected XSS vulnerability through timely patching of the WP-Announcements plugin.
SI-15 mandates filtering of information outputs to neutralize user-supplied input during web page generation, comprehensively preventing reflected XSS payload execution.
SI-10 enforces validation of information inputs to reject or sanitize malicious payloads that could be reflected as XSS in web pages.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The reflected XSS vulnerability directly enables injection of malicious scripts into web pages, facilitating drive-by compromise (T1189) via crafted URLs and allowing theft of web session cookies (T1539) to hijack user sessions on the affected WordPress site.
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brian Messenlehner WP-Announcements wp-announcements allows Reflected XSS.This issue affects WP-Announcements: from n/a through <= 1.8.
Deeper analysisAI
CVE-2025-23489 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as CWE-79, that enables Reflected Cross-site Scripting (XSS) in the WP-Announcements WordPress plugin developed by Brian Messenlehner. This issue affects all versions of the plugin from n/a through 1.8 inclusive, as published on 2025-01-21.
The vulnerability can be exploited by remote attackers requiring no privileges over the network with low attack complexity, though user interaction is necessary. Exploitation changes the scope and results in low impacts to confidentiality, integrity, and availability, yielding a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Attackers can leverage reflected XSS to inject malicious payloads via user-supplied input reflected in web pages.
Patchstack has documented this reflected XSS vulnerability specific to WP-Announcements plugin version 1.8 in their WordPress plugin database.
Details
- CWE(s)