CVE-2025-23610
Published: 22 January 2025
Summary
CVE-2025-23610 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked in the top 43.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses reflected XSS by filtering web page outputs to neutralize malicious scripts from untrusted user inputs in the Ultimate Events plugin.
Validates information inputs to the plugin, preventing improper processing of malicious payloads that could be reflected as executable scripts.
Ensures timely identification, reporting, and patching of the specific XSS flaw affecting Ultimate Events plugin versions through 1.3.3.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS enables crafted malicious links to execute JS in victim browsers, directly facilitating drive-by compromise, spearphishing links, and user execution of malicious content.
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tehsmash Ultimate Events ultimate-events allows Reflected XSS.This issue affects Ultimate Events: from n/a through <= 1.3.3.
Deeper analysisAI
CVE-2025-23610 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Tehsmash Ultimate Events WordPress plugin (ultimate-events). This issue affects all versions from n/a through 1.3.3, as documented in the CVE published on 2025-01-22.
The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating exploitation over the network with low attack complexity, no required privileges, but needing user interaction and resulting in a changed scope. Unauthenticated remote attackers can exploit it by tricking users into interacting with maliciously crafted input reflected in web pages, achieving low impacts on confidentiality, integrity, and availability.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/ultimate-events/vulnerability/wordpress-ultimate-events-plugin-1-3-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)