CVE-2025-23611
Published: 22 January 2025
Summary
CVE-2025-23611 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-23611 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as CWE-79, enabling Reflected Cross-Site Scripting (XSS) in the WH Cache & Security WordPress plugin developed by webhue (package name wh-cache-and-security). The flaw affects all versions of the plugin up to and including 1.1.2. It has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges, and scope change.
Attackers can exploit this vulnerability remotely without authentication by crafting malicious payloads that reflect user input on web pages generated by the plugin. Exploitation requires user interaction, such as a victim clicking a specially crafted link or visiting a malicious site, which triggers the XSS in the browser context of the targeted WordPress site. Successful attacks can lead to low-level impacts on confidentiality (e.g., limited data exposure like cookies), integrity (e.g., minor script injection), and availability, with the changed scope allowing cross-origin effects.
Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/wh-cache-and-security/vulnerability/wordpress-wh-cache-security-plugin-1-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve details the vulnerability and serves as a primary reference for mitigation guidance, though specific patch availability or workaround instructions are outlined there for affected WordPress administrators.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3285
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webhue WH Cache & Security wh-cache-and-security allows Reflected XSS.This issue affects WH Cache & Security: from n/a through <= 1.1.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin enables direct exploitation of the web application (T1190) and requires user interaction via a crafted malicious link (T1204.001).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CVE by requiring timely remediation of the specific reflected XSS flaw in the WH Cache & Security WordPress plugin through patching or updates.
Prevents reflected XSS by validating and sanitizing untrusted user inputs to the web application before processing, blocking malicious payloads.
Prevents XSS execution by filtering and encoding information outputs during web page generation to neutralize injected scripts.