CVE-2025-23595
Published: 03 March 2025
Summary
CVE-2025-23595 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-23595 is an Improper Neutralization of Input During Web Page Generation vulnerability, manifesting as Reflected Cross-site Scripting (XSS) and classified under CWE-79. It affects the brainpulse Page Health-O-Meter WordPress plugin, specifically versions from n/a through 2.0 inclusive. The issue was published on 2025-03-03 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Attackers can exploit this vulnerability remotely over the network with low attack complexity, requiring no privileges but relying on user interaction, such as a victim visiting a maliciously crafted URL. Exploitation reflects attacker-controlled input into the web page, enabling execution of arbitrary JavaScript in the victim's browser context with changed scope. This can result in limited impacts to confidentiality, integrity, and availability, such as session hijacking, data exfiltration, or defacement within the site's domain.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/page-health-o-meter/vulnerability/wordpress-page-health-o-meter-plugin-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve documents the Reflected XSS vulnerability in the Page Health-O-Meter plugin version 2.0 and provides details relevant to mitigation for affected WordPress installations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5706
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brainpulse Page Health-O-Meter page-health-o-meter allows Reflected XSS.This issue affects Page Health-O-Meter: from n/a through <= 2.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables exploitation of internet-facing web applications (T1190) and arbitrary JavaScript execution in victim browser (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires filtering of information prior to output on web pages, preventing reflected XSS from executing arbitrary JavaScript in the victim's browser.
Mandates validation of user inputs to block malicious payloads in URLs that could lead to improper neutralization during web page generation in the Page Health-O-Meter plugin.
Ensures timely identification, reporting, and remediation of the specific flaw in Page Health-O-Meter versions through 2.0, eliminating the XSS vulnerability via patching.