Cyber Resilience

CVE-2025-23683

High

Published: 22 January 2025

Published
22 January 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0023 46.2th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-23683 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2025-23683 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79. It affects the MACME macme component from xdxdVSxdxd, with the issue impacting versions from n/a through 1.2. The vulnerability has a CVSS v3.1 base score of 7.1, rated High, with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L.

Attackers can exploit this remotely over the network with low attack complexity and no required privileges, though it necessitates user interaction such as clicking a malicious link. Successful exploitation changes scope to the victim's browser context, potentially allowing limited impacts on confidentiality, integrity, and availability, such as script execution leading to session token theft or phishing within the affected site.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/macme/vulnerability/wordpress-macme-plugin-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve details the reflected XSS in the WordPress MACME plugin version 1.2.

EU & UK References

Vulnerability details

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xdxdVSxdxd MACME macme allows Reflected XSS.This issue affects MACME: from n/a through <= 1.2.

CWE(s)
CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
attack.mitre.org →
T1539 Steal Web Session Cookie Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
attack.mitre.org →
Why these techniques?

Reflected XSS in public-facing WordPress plugin directly enables T1190 (exploiting web app vuln), T1059.007 (arbitrary JS execution), and T1539 (session token theft via script).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-23538Shared CWE-79
CVE-2026-27099Shared CWE-79
CVE-2025-12716Shared CWE-79
CVE-2026-34563Shared CWE-79
CVE-2025-68883Shared CWE-79
CVE-2024-13875Shared CWE-79
CVE-2026-24778Shared CWE-79
CVE-2025-64539Shared CWE-79
CVE-2024-13055Shared CWE-79
CVE-2026-32308Shared CWE-79

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

SI-10 enforces information input validation at critical entry points, directly preventing reflected XSS by neutralizing untrusted input before web page generation.

SI-15 Information Output Filtering good match
prevent

SI-15 requires information output filtering, which encodes or escapes user-supplied data during web page generation to block malicious script execution.

SI-2 Flaw Remediation good match
prevent

SI-2 mandates timely identification, reporting, and correction of flaws, enabling patching of the specific XSS vulnerability in the MACME plugin.

References