CVE-2025-23652
Published: 14 February 2025
Summary
CVE-2025-23652 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 29.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-23652 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the WordPress plugin "Add custom content after post" by Fabio Zuanon. The plugin, identified as add-custom-content-after-post, is affected in all versions from n/a through 1.0 inclusive. Published on 2025-02-14T13:15:45.333, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
An unauthenticated attacker with network access can exploit this vulnerability through low-complexity attacks that require user interaction, such as tricking a victim into visiting a malicious URL. Exploitation enables script execution in the victim's browser context within the scope of the affected site, resulting in low impacts to confidentiality, integrity, and availability, with a changed scope.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/add-custom-content-after-post/vulnerability/wordpress-add-custom-content-after-post-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3316
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fabio Zuanon Add custom content after post add-custom-content-after-post allows Reflected XSS.This issue affects Add custom content after post: from n/a through <= 1.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The reflected XSS vulnerability enables script execution in the victim's browser when a crafted malicious URL is visited, directly facilitating drive-by compromise (T1189), user execution via malicious link (T1204.001), and spearphishing links (T1566.002).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates reflected XSS by requiring filtering of information outputs to neutralize untrusted input during web page generation in the WordPress plugin.
Prevents reflected XSS exploitation by validating plugin inputs to reject or sanitize malicious scripts before reflection in web pages.
Addresses the specific flaw in the Add custom content after post plugin by requiring timely identification, reporting, and correction of the XSS vulnerability.