CVE-2025-23731
Published: 03 March 2025
Summary
CVE-2025-23731 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked in the top 42.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-23731 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Reflected Cross-site Scripting (XSS) as classified under CWE-79. It affects the Tax Report for WooCommerce WordPress plugin by infosoftplugin, with the issue present in all versions from n/a through 2.2 inclusive. The vulnerability was published on 2025-03-03.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Remote attackers with no required privileges can exploit it over the network with low attack complexity, though it requires user interaction such as visiting a maliciously crafted link. Exploitation allows injection and execution of arbitrary JavaScript in the victim's browser context, resulting in low impacts to confidentiality, integrity, and availability, but with a changed scope that can affect other system resources.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/tax-report-for-woocommerce/vulnerability/wordpress-tax-report-for-woocommerce-plugin-2-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve, which documents the Reflected XSS in Tax Report for WooCommerce version 2.2.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5704
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in infosoftplugin Tax Report for WooCommerce tax-report-for-woocommerce allows Reflected XSS.This issue affects Tax Report for WooCommerce: from n/a through <= 2.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS enables arbitrary JavaScript execution in browser via crafted malicious link.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-15 mandates filtering of information outputs, directly preventing reflected XSS in the Tax Report for WooCommerce plugin by neutralizing malicious input during web page generation.
SI-10 requires validation of inputs, addressing the improper neutralization vulnerability that allows arbitrary JavaScript injection via malicious links in the plugin.
SI-2 ensures timely flaw remediation, such as patching the Tax Report for WooCommerce plugin versions <=2.2 to eliminate the reflected XSS vulnerability.