Cyber Resilience

CVE-2025-23689

High

Published: 16 January 2025

Published
16 January 2025
Modified
28 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0028 51.8th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-23689 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 48.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2025-23689 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Stored Cross-site Scripting (XSS) under CWE-79, in the Blogger Image Import WordPress plugin, also referred to as Poco Blogger Image Import. The issue affects versions from 2.1 through all subsequent releases.

Unauthenticated attackers with network access can exploit this vulnerability with low attack complexity and user interaction required, achieving a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Exploitation involves CSRF leading to stored XSS, allowing attackers to inject malicious scripts that execute in the context of other users viewing affected pages.

The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/blogger-image-import/vulnerability/wordpress-blogger-image-import-plugin-2-1-csrf-to-stored-xss-vulnerability?_s_id=cve documents the CSRF-to-stored XSS vulnerability in the Blogger Image Import plugin version 2.1 and provides details on mitigation.

EU & UK References

Vulnerability details

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Poco Blogger Image Import allows Stored XSS.This issue affects Blogger Image Import: from 2.1 through n/a.

CWE(s)
CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
attack.mitre.org →
Why these techniques?

Stored XSS in public-facing WordPress plugin directly enables exploitation of public-facing applications (T1190) and facilitates arbitrary JavaScript execution in victim browsers (T1059.007).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-3231Shared CWE-79
CVE-2025-23481Shared CWE-79
CVE-2025-69302Shared CWE-79
CVE-2025-23734Shared CWE-79
CVE-2025-23571Shared CWE-79
CVE-2025-65110Shared CWE-79
CVE-2026-24948Shared CWE-79
CVE-2025-27352Shared CWE-79
CVE-2025-30349Shared CWE-79
CVE-2026-3876Shared CWE-79

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

SI-10 requires validating and neutralizing information inputs, directly preventing the improper neutralization exploited in this stored XSS vulnerability.

SI-15 Information Output Filtering good match
prevent

SI-15 enforces output filtering for web page generation, blocking execution of attacker-injected scripts when pages are viewed.

SI-2 Flaw Remediation good match
prevent

SI-2 mandates identification and timely remediation of software flaws, addressing the specific XSS vulnerability in the Blogger Image Import plugin.

References