CVE-2025-23516
Published: 03 March 2025
Summary
CVE-2025-23516 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 29.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 directly enforces validation of untrusted inputs to prevent improper neutralization that enables reflected XSS attacks.
SI-15 requires filtering of information outputs during web page generation to block execution of injected JavaScript from malicious URLs.
SI-2 mandates identification, reporting, and remediation of flaws such as this specific XSS vulnerability in the WordPress plugin through patching.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The reflected XSS vulnerability directly enables execution of arbitrary JavaScript code in the victim's browser context via a crafted URL.
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brainvireinfo Sale with Razorpay sell-with-razorpay allows Reflected XSS.This issue affects Sale with Razorpay: from n/a through <= 1.0.
Deeper analysisAI
CVE-2025-23516 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the brainvireinfo "Sale with Razorpay" WordPress plugin, also known as sell-with-razorpay. This issue affects all versions from n/a through 1.0 inclusive. The vulnerability was published on 2025-03-03 and carries a CVSS v3.1 base score of 7.1.
Attackers can exploit this Reflected XSS over the network (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) but user interaction (UI:R), resulting in a changed scope (S:C) with low impacts on confidentiality, integrity, and availability (C:L/I:L/A:L). A remote unauthenticated attacker could trick a user into visiting a maliciously crafted URL on a vulnerable site, leading to execution of arbitrary JavaScript in the victim's browser context.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/sell-with-razorpay/vulnerability/wordpress-sale-with-razorpay-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve provides details on this vulnerability in the WordPress Sale with Razorpay plugin version 1.0.
Details
- CWE(s)