CVE-2025-23519
Published: 03 March 2025
Summary
CVE-2025-23519 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Spearphishing Link (T1566.002); ranked at the 45.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 mandates remediation of the specific Reflected XSS flaw in G Web Pro Store Locator plugin versions through <=2.0.1 by applying patches or updates.
SI-15 filters information output during web page generation in the store locator plugin to neutralize reflected malicious scripts and prevent execution in victims' browsers.
SI-10 validates inputs to the G Web Pro Store Locator plugin, blocking malicious payloads that could be reflected as XSS in generated web pages.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS enables exploitation via crafted malicious links to trigger browser script execution (T1566.002) for impacts including session token exfiltration (T1539).
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jas Saran G Web Pro Store Locator gwebpro-store-locator allows Reflected XSS.This issue affects G Web Pro Store Locator: from n/a through <= 2.0.1.
Deeper analysisAI
CVE-2025-23519 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, affecting the WordPress plugin G Web Pro Store Locator (gwebpro-store-locator) developed by Jas Saran. The issue impacts all versions from n/a through 2.0.1 inclusive. Published on 2025-03-03, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to network accessibility and scope change.
Unauthenticated attackers can exploit this vulnerability remotely with low attack complexity by tricking users into interacting with a maliciously crafted link or input reflected in the web page. Successful exploitation executes arbitrary scripts in the victim's browser context, enabling low-level impacts such as limited data exfiltration (e.g., session tokens), page manipulation, or minor denial of service within the changed scope.
The Patchstack advisory documents the Reflected XSS vulnerability specifically in G Web Pro Store Locator plugin version 2.0.1 and earlier for WordPress, highlighting the affected component and providing details on the issue.
Details
- CWE(s)