CVE-2025-23570
Published: 03 March 2025
Summary
CVE-2025-23570 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-23570 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, affecting the WP Social Links WordPress plugin developed by Mitchell Bundy (wp-social-links). The issue impacts all versions from n/a through 0.3.1. Published on 2025-03-03, it carries a CVSS v3.1 base score of 7.1 (High), with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating network accessibility, low complexity, no privileges required, user interaction needed, changed scope, and low impacts across confidentiality, integrity, and availability.
Unauthenticated attackers (PR:N) can exploit this reflected XSS over the network (AV:N) by crafting malicious links or inputs that, when interacted with by a user (UI:R), inject and execute arbitrary scripts in the victim's browser context due to insufficient input sanitization during web page generation. Successful exploitation enables low-level impacts such as limited data exfiltration (e.g., session tokens), minor page modifications, or restricted denial of service, amplified by the changed scope (S:C) to affect the site's security context.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp-social-links/vulnerability/wordpress-wp-social-links-plugin-0-3-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve details the vulnerability and recommends updating the WP Social Links plugin to a version beyond 0.3.1, where the issue is addressed.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5725
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mitchell Bundy WP Social Links wp-social-links allows Reflected XSS.This issue affects WP Social Links: from n/a through <= 0.3.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a reflected XSS vulnerability in a public-facing WordPress plugin, directly enabling exploitation of public-facing applications via crafted malicious links to execute arbitrary scripts in the victim's browser for impacts like session token exfiltration.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces validation and sanitization of user inputs to prevent improper neutralization leading to reflected XSS script injection in the WP Social Links plugin.
Requires filtering and encoding of information outputs during web page generation to neutralize malicious inputs and block XSS payload execution.
Ensures timely flaw remediation by patching the WP Social Links plugin to versions beyond 0.3.1 where the XSS vulnerability is fixed.