CVE-2025-23568
Published: 14 February 2025
Summary
CVE-2025-23568 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-23568 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the WP Login Attempt Log WordPress plugin by fredsted. The issue affects the wp-login-attempt-log plugin in all versions from n/a through 1.3 inclusive.
The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating it is exploitable remotely over the network with low attack complexity and no privileges required, though it demands user interaction. Attackers can trick authenticated or unauthenticated users into accessing a maliciously crafted link or page, leading to arbitrary script execution in the victim's browser within the context of the affected site and with changed scope to cross-origin, enabling limited impacts on confidentiality, integrity, and availability such as session hijacking or minor data manipulation.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp-login-attempt-log/vulnerability/wordpress-wp-login-attempt-log-plugin-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve documents the Reflected XSS vulnerability in wp-login-attempt-log version 1.3 and provides details relevant to mitigation for WordPress administrators.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3253
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fredsted WP Login Attempt Log wp-login-attempt-log allows Reflected XSS.This issue affects WP Login Attempt Log: from n/a through <= 1.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The reflected XSS vulnerability in a public-facing WordPress plugin directly enables exploitation of the web application (T1190) to inject and execute arbitrary JavaScript in the victim's browser (T1059.007) via a crafted link.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses reflected XSS by requiring output filtering to neutralize untrusted input during web page generation in the vulnerable WordPress plugin.
Prevents injection of malicious scripts by validating and sanitizing user inputs before processing in the WP Login Attempt Log plugin.
Mitigates the vulnerability through timely flaw remediation by patching the affected WP Login Attempt Log plugin versions up to 1.3.