CVE-2025-23590
Published: 03 February 2025
Summary
CVE-2025-23590 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 12.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation and sanitization of user inputs to block malicious scripts from being processed during web page generation in reflected XSS attacks.
Mandates filtering and encoding of outputs sent to web pages, directly neutralizing reflected XSS payloads injected via untrusted inputs.
Ensures flaws like this reflected XSS vulnerability in the Dezdy plugin are identified, reported, and remediated through timely patching.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin enables exploitation via malicious links (T1190, T1204.001) to execute arbitrary JavaScript (T1059.007) for session hijacking (T1185).
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dezdy.com Dezdy dezdy-mcommerce allows Reflected XSS.This issue affects Dezdy: from n/a through <= 1.0.
Deeper analysisAI
CVE-2025-23590 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, affecting the Dezdy dezdy-mcommerce WordPress plugin. The issue impacts Dezdy versions from n/a through 1.0 and was published on 2025-02-03.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating it is exploitable over the network with low attack complexity, no required privileges, but necessitating user interaction. Remote attackers can craft malicious links or inputs that, when processed by the plugin during web page generation, inject and execute arbitrary scripts in a victim's browser, potentially leading to limited impacts on confidentiality, integrity, and availability within a changed scope, such as session hijacking or data exfiltration.
Advisories, including the Patchstack database entry at https://patchstack.com/database/Wordpress/Plugin/dezdy-mcommerce/vulnerability/wordpress-dezdy-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve, provide further details on the vulnerability in the context of the WordPress Dezdy plugin.
Details
- CWE(s)