CVE-2025-23631
Published: 22 January 2025
Summary
CVE-2025-23631 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 42.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-23631 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Sarah Lewis Content Planner WordPress plugin (content-planner). This issue affects the plugin from unknown initial versions (n/a) through version 1.0 inclusive. The vulnerability was published on 2025-01-22 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility and scope change potential.
Attackers can exploit this Reflected XSS remotely over the network with low attack complexity and no privileges required, though it necessitates user interaction, such as visiting a maliciously crafted link or page. No authentication is needed, making it accessible to unauthenticated remote attackers. Successful exploitation enables limited impacts on confidentiality, integrity, and availability (low ratings across all), but the changed scope (S:C) allows effects to propagate beyond the vulnerable component, potentially compromising other users' sessions or linked applications via injected scripts.
The primary advisory from Patchstack, available at https://patchstack.com/database/Wordpress/Plugin/content-planner/vulnerability/wordpress-content-planner-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve, documents the Reflected XSS in Content Planner version 1.0 and provides details on the vulnerability for WordPress environments. Security practitioners should review this reference for specific patch availability, workaround recommendations, and collection status updates.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3300
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sarah Lewis Content Planner content-planner allows Reflected XSS.This issue affects Content Planner: from n/a through <= 1.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables exploitation of web applications (T1190) and client-side JavaScript execution via crafted links (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-15 requires filtering of information outputs to prevent execution of injected malicious scripts in reflected XSS attacks.
SI-10 enforces validation of information inputs, directly countering the improper neutralization of input that enables this reflected XSS vulnerability.
SI-2 mandates timely flaw remediation, including patching the vulnerable Content Planner plugin to eliminate the XSS issue.