CVE-2025-23722
Published: 23 January 2025
Summary
CVE-2025-23722 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly enforces validation and neutralization of user inputs to prevent reflected XSS exploitation in the Mind3doM RyeBread Widgets plugin.
Requires filtering of information outputs during web page generation to block reflection of malicious scripts in victim browsers.
Mandates timely identification, reporting, and correction of the specific XSS flaw affecting all versions of the plugin up to 1.0.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables T1190 (exploit public-facing app), T1059.007 (arbitrary JavaScript execution), and T1185 (browser session hijacking via malicious link and JS).
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mind3dom Mind3doM RyeBread Widgets mind3dom-ryebread-widgets allows Reflected XSS.This issue affects Mind3doM RyeBread Widgets: from n/a through <= 1.0.
Deeper analysisAI
CVE-2025-23722 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Mind3doM RyeBread Widgets WordPress plugin (mind3dom-ryebread-widgets). This issue affects all versions from n/a through 1.0 inclusive. The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), reflecting network accessibility, low complexity, no required privileges, user interaction, scope change, and low impacts across confidentiality, integrity, and availability.
A remote, unauthenticated attacker can exploit this vulnerability by crafting malicious input that is reflected back in web page generation, tricking a user into interacting with it—such as clicking a malicious link. Successful exploitation executes arbitrary JavaScript in the victim's browser context, potentially enabling actions like session hijacking, data theft, or further phishing within the scope changed by the cross-origin effects.
Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/mind3dom-ryebread-widgets/vulnerability/wordpress-mind3dom-ryebread-widgets-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve documents the vulnerability in the WordPress plugin context.
Details
- CWE(s)