CVE-2025-23548
Published: 22 January 2025
Summary
CVE-2025-23548 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-23548 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Responsivity WordPress plugin developed by Bilal TAS. The issue affects all versions of the plugin from n/a through 0.0.6 inclusive.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no privileges required, and user interaction needed. Remote attackers can exploit it by tricking users into accessing crafted URLs or inputs that reflect malicious payloads in the web page, executing scripts in the victim's browser context and achieving low impacts to confidentiality, integrity, and availability with changed scope.
The primary advisory from Patchstack (https://patchstack.com/database/Wordpress/Plugin/responsivity/vulnerability/wordpress-responsivity-plugin-0-0-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve) documents the vulnerability in the WordPress Responsivity plugin version 0.0.6. Practitioners should review this reference for specific mitigation recommendations, such as applying available patches or updates to affected installations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3243
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bilal TAS Responsivity responsivity allows Reflected XSS.This issue affects Responsivity: from n/a through <= 0.0.6.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin enables exploitation of the web application via crafted malicious URLs requiring user interaction to trigger script execution in browser.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-15 directly prevents reflected XSS by requiring filtering and encoding of user inputs prior to output on web pages, addressing the improper neutralization in the Responsivity plugin.
SI-10 enforces validation of all information inputs to reject malicious payloads like XSS scripts before they are reflected in the Responsivity plugin's web page generation.
SI-2 mandates timely flaw remediation, including patching the known XSS vulnerability in Responsivity versions through 0.0.6 to eliminate the root cause.