CVE-2025-23602
Published: 22 January 2025
Summary
CVE-2025-23602 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious Link (T1204.001); ranked in the top 42.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates timely identification, reporting, and correction of the specific reflected XSS flaw in the EELV Newsletter plugin through patching.
Requires filtering of information output during web page generation to neutralize malicious input and prevent JavaScript injection in reflected XSS attacks.
Implements input validation at entry points to reject or sanitize malicious payloads before they are reflected in dynamically generated web pages.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS enables attackers to craft malicious links that trigger arbitrary JS execution upon user click (T1204.001) and directly facilitates theft of web session cookies for hijacking (T1539).
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Europe Ecologie Les Verts EELV Newsletter eelv-newsletter allows Reflected XSS.This issue affects EELV Newsletter: from n/a through <= 4.8.2.
Deeper analysisAI
CVE-2025-23602 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-Site Scripting (XSS) under CWE-79, affecting the EELV Newsletter WordPress plugin developed by Europe Ecologie Les Verts. The issue impacts all versions of the plugin up to and including 4.8.2. It has a CVSS v3.1 base score of 7.1, reflecting medium severity with network accessibility, low attack complexity, no required privileges, user interaction needed, changed scope, and low impacts to confidentiality, integrity, and availability.
Unauthenticated attackers can exploit this vulnerability remotely by crafting malicious links that, when clicked by users visiting affected WordPress sites with the plugin enabled, inject and execute arbitrary JavaScript in the victim's browser context. Successful exploitation enables attackers to steal session cookies, perform actions on behalf of the user, or deface pages, leveraging the reflected nature for phishing or session hijacking scenarios requiring user interaction.
Patchstack documents this vulnerability in their database, highlighting the Reflected XSS in the EELV Newsletter plugin version 4.8.2 and providing details for WordPress administrators to assess exposure.
Details
- CWE(s)