CVE-2025-23498
Published: 22 January 2025
Summary
CVE-2025-23498 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-23498 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Translation.Pro WordPress plugin (translation-pro) developed by ContentLocalized. This issue affects all versions of the plugin up to and including 1.0.0, as published on 2025-01-22.
The vulnerability carries a CVSS v3.1 base score of 7.1 (High), with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. Remote attackers require no privileges and can exploit it over the network with low complexity by tricking authenticated users into interacting with maliciously crafted input, such as a specially crafted link or request. Successful exploitation enables script execution in the victim's browser within the context of the affected site (changed scope), potentially leading to low-level impacts on confidentiality, integrity, and availability, such as session hijacking, data theft, or page manipulation.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/translation-pro/vulnerability/wordpress-translation-pro-plugin-1-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve documents this Reflected XSS vulnerability in Translation.Pro version 1.0.0 and provides details for mitigation, which security practitioners should consult for patching instructions or workarounds.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3211
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ContentLocalized Translation.Pro translation-pro allows Reflected XSS.This issue affects Translation.Pro: from n/a through <= 1.0.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin enables exploitation of the web application (T1190) and arbitrary JavaScript execution in the victim's browser (T1059.007), often via crafted links.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Information output filtering directly neutralizes malicious scripts in reflected XSS by encoding or sanitizing user input before rendering in web pages.
Information input validation checks and rejects malicious payloads in user-supplied input, preventing their reflection in generated web pages.
Flaw remediation requires identifying and patching the improper neutralization vulnerability in the Translation.Pro plugin to eliminate the XSS issue.