CVE-2025-23679

High

Published: 22 January 2025

Published

22 January 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS Score 0.0023 46.2th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-23679 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2025-23679 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Reflected Cross-site Scripting (XSS) as classified under CWE-79. It affects the Flourish Pixel FP RSS Category Excluder WordPress plugin (fp-rss-category-excluder) in all versions from n/a through 1.0.0. The issue was published on 2025-01-22 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

Attackers can exploit this vulnerability remotely over the network with low complexity and no required privileges, though it necessitates user interaction such as clicking a malicious link or submitting crafted input to a vulnerable site. Exploitation reflects unsanitized input into web pages, allowing arbitrary JavaScript execution in the victim's browser context. With a changed scope (S:C), this can result in low impacts to confidentiality, integrity, and availability, such as session hijacking or data theft from authenticated users.

The primary advisory from Patchstack documents the Reflected XSS in FP RSS Category Excluder version 1.0.0 and is available at https://patchstack.com/database/Wordpress/Plugin/fp-rss-category-excluder/vulnerability/wordpress-fp-rss-category-excluder-plugin-1-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve. Practitioners should review this resource for detailed mitigation steps, including any available patches or workarounds.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-3338

Vulnerability details

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Flourish Pixel FP RSS Category Excluder fp-rss-category-excluder allows Reflected XSS.This issue affects FP RSS Category Excluder: from n/a through <= 1.0.0.

CWE(s): CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1204.001 Malicious Link Execution

An adversary may rely upon a user clicking a malicious link in order to gain execution.

attack.mitre.org →

Why these techniques?

The CVE describes a reflected XSS vulnerability in a public-facing WordPress plugin, directly enabling exploitation of public-facing applications via T1190. The attack vector requires user interaction with a malicious link to trigger the unsanitized input reflection and arbitrary JavaScript execution, mapping to T1204.001.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1