CVE-2025-23598
Published: 14 February 2025
Summary
CVE-2025-23598 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents reflected XSS by filtering and encoding user input reflected in web page output to block JavaScript execution.
Enforces validation of untrusted inputs to neutralize malicious scripts before they are processed and reflected in Recip.ly plugin responses.
Requires timely flaw remediation to patch the specific reflected XSS vulnerability in Recip.ly WordPress plugin versions through 1.1.8.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin enables exploitation of web application (T1190) for arbitrary JavaScript execution in browser (T1059.007), typically via crafted malicious URLs in spearphishing (T1566.002).
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in craig.edmunds@gmail.com Recip.ly reciply allows Reflected XSS.This issue affects Recip.ly: from n/a through <= 1.1.8.
Deeper analysisAI
CVE-2025-23598 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Reflected Cross-site Scripting (XSS) as classified under CWE-79. It affects the Recip.ly WordPress plugin (also referenced as recip-ly), developed by craig.edmunds@gmail.com, across all versions from n/a through 1.1.8 inclusive.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility with low attack complexity, no required privileges, but necessitating user interaction. Remote attackers can exploit it by tricking authenticated or unauthenticated users—such as site visitors or administrators—into interacting with malicious input, like a crafted URL or form submission. Successful exploitation allows injection and execution of arbitrary JavaScript in the victim's browser context, with low impacts on confidentiality, integrity, and availability due to the changed scope.
Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/reciply/vulnerability/wordpress-recip-ly-plugin-1-1-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve documents the reflected XSS issue specifically in Recip.ly plugin version 1.1.8 for WordPress, providing details for security practitioners to assess and address exposure in affected environments.
Details
- CWE(s)