CVE-2025-23650
Published: 14 February 2025
Summary
CVE-2025-23650 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 29.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-23650 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, affecting the Tidy.ro WordPress plugin developed by razvypp. This issue impacts all versions of the plugin from n/a through 1.3 inclusive, as published on 2025-02-14 with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
The vulnerability enables remote attackers to exploit it over the network with low attack complexity and no privileges required, though user interaction is necessary. Exploitation involves injecting malicious scripts via reflected input, allowing attackers to execute code in the context of affected users' browsers and achieve low impacts on confidentiality, integrity, and availability with a changed scope.
Patchstack has documented this Reflected XSS vulnerability in their database entry for the WordPress Tidy.ro plugin version 1.3, providing details on the issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3314
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in razvypp Tidy.ro tidyro allows Reflected XSS.This issue affects Tidy.ro: from n/a through <= 1.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS directly enables injection and execution of arbitrary JavaScript in the victim's browser (T1059.007) and is typically triggered by an attacker-crafted malicious link requiring user interaction (T1204.001).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-15 requires filtering of information outputs to neutralize malicious scripts during web page generation, directly mitigating the reflected XSS vulnerability in Tidy.ro.
SI-10 enforces validation of information inputs, preventing the injection of malicious scripts exploited in this reflected XSS issue.
SI-2 mandates identification and remediation of system flaws, such as patching the vulnerable Tidy.ro WordPress plugin versions affected by this XSS.