CVE-2025-23545
Published: 23 January 2025
Summary
CVE-2025-23545 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Spearphishing Link (T1566.002); ranked at the 38.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-15 (Information Output Filtering) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Filters information prior to output on web pages to neutralize malicious scripts, directly preventing reflected XSS exploitation in the WordPress plugin.
Validates inputs at system entry points to reject or sanitize malicious payloads before they are reflected in web page generation.
Ensures timely identification, reporting, and correction of flaws like this reflected XSS vulnerability through patching the affected WP Social Broadcast plugin.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in the plugin enables exploitation via crafted malicious links (T1566.002 Spearphishing Link) and allows injected JavaScript to steal web session cookies or session data (T1539 Steal Web Session Cookie).
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Navnish Bhardwaj WP Social Broadcast wp-social-broadcast allows Reflected XSS.This issue affects WP Social Broadcast: from n/a through <= 1.0.0.
Deeper analysisAI
CVE-2025-23545 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Reflected Cross-site Scripting (XSS) as classified under CWE-79. It affects the WP Social Broadcast WordPress plugin (wp-social-broadcast) developed by Navnish Bhardwaj, impacting all versions from n/a through 1.0.0 inclusive. The vulnerability was published on 2025-01-23.
The issue carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no privileges required, and user interaction needed for exploitation. Remote attackers can craft malicious payloads delivered via reflected inputs, tricking users into interacting (e.g., via a phishing link). Successful exploitation allows limited impacts on confidentiality, integrity, and availability within a changed scope, such as executing scripts in the victim's browser to steal session data or perform other client-side actions.
Patchstack provides details on the vulnerability, including mitigation guidance, in their advisory at https://patchstack.com/database/Wordpress/Plugin/wp-social-broadcast/vulnerability/wordpress-wp-social-broadcast-plugin-1-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)