CVE-2025-23584
Published: 03 March 2025
Summary
CVE-2025-23584 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-15 (Information Output Filtering) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-23584 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the WordPress plugin "Pin Locations on Map" by arsh91. The issue affects the plugin from unknown initial versions through version 1.0 inclusive. Published on 2025-03-03, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility and scope change.
Attackers can exploit this reflected XSS vulnerability remotely over the network with low attack complexity and no required privileges, though it necessitates user interaction such as clicking a malicious link. Exploitation reflects unsanitized input into the web page, enabling script execution in the victim's browser context. This can result in limited impacts to confidentiality, integrity, and availability, such as session token theft or minor site defacement, particularly if the victim has elevated privileges on the WordPress site.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/pin-locations-on-map/vulnerability/wordpress-pin-locations-on-map-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve, which covers the reflected XSS in the Pin Locations on Map plugin version 1.0. Security practitioners should consult this reference for patching instructions and workaround guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5690
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arsh91 Pin Locations on Map pin-locations-on-map allows Reflected XSS.This issue affects Pin Locations on Map: from n/a through <= 1.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin is exploited via malicious links (spearphishing) to execute scripts in victim's browser.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the improper neutralization of input during web page generation by filtering outputs to prevent reflected XSS script execution.
Remediates the specific reflected XSS flaw in the Pin Locations on Map WordPress plugin through timely patching as referenced in the Patchstack advisory.
Validates inputs to block malicious payloads that could be reflected without neutralization in web pages, complementing output filtering.