CVE-2025-23681
Published: 22 January 2025
Summary
CVE-2025-23681 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents reflected XSS by filtering malicious input from web page output before rendering in the victim's browser.
Enforces validation of untrusted inputs like URL parameters in the REDIRECTION PLUS plugin to block XSS payloads.
Mandates timely remediation of the specific flaw in REDIRECTION PLUS versions through 2.0.0 via patching.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables exploitation of public-facing applications (T1190) and facilitates stealing web session cookies via browser script execution (T1539).
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tahminajannat REDIRECTION PLUS redirection-plus allows Reflected XSS.This issue affects REDIRECTION PLUS: from n/a through <= 2.0.0.
Deeper analysisAI
CVE-2025-23681 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Reflected Cross-site Scripting (XSS) as classified under CWE-79. It affects the REDIRECTION PLUS WordPress plugin by tahminajannat (redirection-plus), impacting all versions from its initial release through 2.0.0. The vulnerability was published on 2025-01-22.
The issue carries a CVSS v3.1 base score of 7.1 (High) with the vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. Remote attackers require no privileges and can exploit it over the network with low attack complexity by tricking authenticated users into interacting with malicious input, such as via a crafted link or request reflected in the web page. Exploitation changes the security scope, allowing limited impacts on confidentiality, integrity, and availability, such as executing scripts in the victim's browser context to steal session cookies or perform other client-side actions.
Patchstack provides detailed advisory information on this vulnerability, including analysis specific to the WordPress REDIRECTION PLUS plugin version 2.0.0, accessible at https://patchstack.com/database/Wordpress/Plugin/redirection-plus/vulnerability/wordpress-redirection-plus-plugin-2-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)