CVE-2025-23721
Published: 03 March 2025
Summary
CVE-2025-23721 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 42.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-23721 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, affecting the Mobigate WordPress plugin (mobigatevn) from cloudvn. The issue impacts all versions of the plugin from n/a through 1.0.3 inclusive, as disclosed on March 3, 2025.
With a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the vulnerability is exploitable remotely over the network by unauthenticated attackers requiring low attack complexity and user interaction, such as clicking a malicious link. Successful exploitation changes the security scope to cross-instance, enabling low-level impacts on confidentiality, integrity, and availability, such as injecting scripts into reflected user input to steal session cookies or perform other client-side actions in the victim's browser.
Patchstack provides details on the vulnerability in their database entry at https://patchstack.com/database/Wordpress/Plugin/mobigatevn/vulnerability/wordpress-mobigate-plugin-1-0-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve, which security practitioners should consult for recommended mitigations, such as updating the plugin or applying input sanitization.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5697
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cloudvn Mobigate mobigatevn allows Reflected XSS.This issue affects Mobigate: from n/a through <= 1.0.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The reflected XSS vulnerability in a public-facing WordPress plugin directly enables exploitation of public-facing applications (T1190) and facilitates arbitrary JavaScript execution in the victim's browser to perform actions such as stealing session cookies.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces validation and sanitization of user inputs to neutralize malicious scripts reflected in web page generation, addressing the core CWE-79 flaw.
Requires filtering of information outputs prior to rendering in web pages to prevent execution of injected scripts in victims' browsers.
Mandates identification, reporting, and correction of flaws like this reflected XSS vulnerability through timely patching of the affected Mobigate plugin.