CVE-2025-23549
Published: 03 March 2025
Summary
CVE-2025-23549 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses improper neutralization of input during web page generation by filtering outputs to prevent injection of malicious scripts in reflected XSS attacks.
Validates untrusted inputs like malicious URL parameters before reflection in web pages, blocking XSS payloads from being processed.
Remediates the specific XSS flaw in the Maniac SEO WordPress plugin through timely patching, eliminating the vulnerability root cause.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables arbitrary JavaScript execution in browser (T1059.007), facilitating session hijacking (T1185) and web session cookie theft (T1539) via malicious URL; maps to initial access via public app exploitation (T1190).
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in agora32 Maniac SEO maniac-seo allows Reflected XSS.This issue affects Maniac SEO: from n/a through <= 2.0.
Deeper analysisAI
CVE-2025-23549 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Maniac SEO WordPress plugin by agora32. The issue affects all versions of the Maniac SEO plugin from n/a through 2.0 inclusive. Published on 2025-03-03, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Remote attackers require no privileges and can exploit this over the network with low attack complexity, though user interaction is needed, such as visiting a maliciously crafted URL. Exploitation results in execution of arbitrary scripts in the victim's browser due to the changed scope (S:C), enabling limited impacts on confidentiality, integrity, and availability, such as potential session hijacking or data theft within the browser context.
The Patchstack advisory documents this Reflected XSS vulnerability specifically in WordPress Maniac SEO plugin version 2.0 and serves as a primary reference for details on the issue.
Details
- CWE(s)