CVE-2025-23538
Published: 03 March 2025
Summary
CVE-2025-23538 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-23538 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the WP Contest WordPress plugin by Sophia M Williams. The issue affects the plugin from unknown initial versions through 1.0.0. Published on 2025-03-03, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Attackers can exploit this vulnerability remotely over the network with low complexity and no required privileges, though it necessitates user interaction such as clicking a malicious link. Upon successful exploitation, adversaries achieve reflected XSS, enabling limited impacts on confidentiality, integrity, and availability across a changed scope, potentially allowing theft of user session data or execution of scripts in the victim's browser context.
The Patchstack advisory provides details on this vulnerability in WP Contest version 1.0.0: https://patchstack.com/database/Wordpress/Plugin/wp-contest/vulnerability/wordpress-wp-contest-plugin-1-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5717
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sophia M Williams WP Contest wp-contest allows Reflected XSS.This issue affects WP Contest: from n/a through <= 1.0.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The reflected XSS vulnerability in a public-facing WordPress plugin enables exploitation of public-facing applications (T1190), execution of JavaScript in the victim's browser (T1059.007), and stealing of web session cookies (T1539).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-15 requires filtering of information outputs to prevent reflected XSS by ensuring user inputs are properly encoded before rendering in web pages.
SI-10 mandates validation of information inputs, directly addressing the improper neutralization of input that enables the reflected XSS in the WP Contest plugin.
SI-2 ensures timely identification, reporting, and correction of flaws like this specific XSS vulnerability through patching the affected plugin versions up to 1.0.0.