CVE-2025-23523
Published: 14 February 2025
Summary
CVE-2025-23523 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 29.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Remediating the specific reflected XSS flaw in the HSS Embed Streaming Video WordPress plugin up to version 3.23 directly eliminates the vulnerability.
Filtering information outputs during web page generation ensures proper neutralization of untrusted input, preventing reflected XSS execution in the victim's browser.
Validating inputs to the plugin prevents malicious payloads from being accepted and reflected in generated web pages.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS vulnerability directly enables arbitrary JavaScript execution in the victim's browser (T1059.007) and is exploited via a maliciously crafted link requiring user interaction, facilitating spearphishing link delivery (T1566.002).
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hoststreamsell HSS Embed Streaming Video hss-embed-streaming-video allows Reflected XSS.This issue affects HSS Embed Streaming Video: from n/a through <= 3.23.
Deeper analysisAI
CVE-2025-23523 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS, CWE-79), in the hoststreamsell HSS Embed Streaming Video WordPress plugin (hss-embed-streaming-video). The issue affects all versions from n/a through 3.23 inclusive, with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
A remote attacker can exploit this vulnerability over the network with low attack complexity and no privileges required, though it necessitates user interaction such as visiting a maliciously crafted link or page. Exploitation changes the scope of impact, enabling limited effects on confidentiality, integrity, and availability, typically through execution of arbitrary JavaScript in the context of the victim's browser session.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/hss-embed-streaming-video/vulnerability/wordpress-hss-embed-streaming-video-plugin-3-23-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve) documents the Reflected XSS vulnerability in the HSS Embed Streaming Video WordPress plugin up to version 3.23.
Details
- CWE(s)