CVE-2025-23546
Published: 26 March 2025
Summary
CVE-2025-23546 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-23546 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the WordPress plugin RDP inGroups+ (rdp-ingroups) by Robert D Payne. The issue affects all versions from n/a through 1.0.6. Published on 2025-03-26T15:15:57.993, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Attackers can exploit this remotely over the network with low complexity and no required privileges, but it necessitates user interaction such as clicking a malicious link or submitting crafted input. Successful exploitation reflects attacker-controlled scripts into the victim's browser context, enabling actions like session hijacking or data theft within the scope of the affected site, with low impacts to confidentiality, integrity, and availability due to the changed scope.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/rdp-ingroups/vulnerability/wordpress-rdp-ingroups-plugin-1-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve provides details on the vulnerability in the WordPress RDP inGroups+ plugin version 1.0.6.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8194
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert D Payne RDP inGroups+ rdp-ingroups allows Reflected XSS.This issue affects RDP inGroups+: from n/a through <= 1.0.6.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin enables exploitation of web applications (T1190) and execution of JavaScript in browser (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires filtering and sanitizing information prior to output to web pages, preventing reflected XSS by neutralizing attacker-controlled input during web page generation.
Mandates validation of external inputs using explicit rules, blocking malicious scripts from being accepted and reflected in responses.
Requires timely identification, reporting, and correction of software flaws, such as patching the vulnerable RDP inGroups+ WordPress plugin to eliminate the XSS vulnerability.