CVE-2025-23689
Published: 16 January 2025
Summary
CVE-2025-23689 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 requires validating and neutralizing information inputs, directly preventing the improper neutralization exploited in this stored XSS vulnerability.
SI-15 enforces output filtering for web page generation, blocking execution of attacker-injected scripts when pages are viewed.
SI-2 mandates identification and timely remediation of software flaws, addressing the specific XSS vulnerability in the Blogger Image Import plugin.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public-facing WordPress plugin directly enables exploitation of public-facing applications (T1190) and facilitates arbitrary JavaScript execution in victim browsers (T1059.007).
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Poco Blogger Image Import allows Stored XSS.This issue affects Blogger Image Import: from 2.1 through n/a.
Deeper analysisAI
CVE-2025-23689 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Stored Cross-site Scripting (XSS) under CWE-79, in the Blogger Image Import WordPress plugin, also referred to as Poco Blogger Image Import. The issue affects versions from 2.1 through all subsequent releases.
Unauthenticated attackers with network access can exploit this vulnerability with low attack complexity and user interaction required, achieving a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Exploitation involves CSRF leading to stored XSS, allowing attackers to inject malicious scripts that execute in the context of other users viewing affected pages.
The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/blogger-image-import/vulnerability/wordpress-blogger-image-import-plugin-2-1-csrf-to-stored-xss-vulnerability?_s_id=cve documents the CSRF-to-stored XSS vulnerability in the Blogger Image Import plugin version 2.1 and provides details on mitigation.
Details
- CWE(s)