CVE-2025-23732
Published: 22 January 2025
Summary
CVE-2025-23732 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates reflected XSS by filtering and encoding information prior to output on web pages to prevent script injection.
Validates and sanitizes user inputs to block malicious scripts from being processed and reflected in web responses.
Ensures timely remediation of flaws like this plugin vulnerability through patching to versions beyond 2.5.0.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin enables exploitation of the web application (T1190) via malicious links (T1566.002) that execute arbitrary JavaScript in the victim's browser (T1059.007), potentially leading to session theft or unauthorized actions.
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in franciscopalacios Easy Filtering easy-filtering allows Reflected XSS.This issue affects Easy Filtering: from n/a through <= 2.5.0.
Deeper analysisAI
CVE-2025-23732 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the WordPress plugin Easy Filtering (easy-filtering) by franciscopalacios. This issue affects all versions of the plugin from n/a through 2.5.0 inclusive. It carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and was published on 2025-01-22T15:15:22.640.
The vulnerability can be exploited by remote attackers with network access, requiring low attack complexity, no privileges, and user interaction such as clicking a malicious link. Exploitation results in reflected XSS within a changed security scope, enabling limited impacts on confidentiality, integrity, and availability, such as executing scripts in the victim's browser context to steal session data or perform unauthorized actions on the affected site.
Patchstack advisories document this reflected XSS vulnerability specifically in Easy Filtering version 2.5.0 for WordPress, highlighting the issue in their vulnerability database. Mitigation requires updating the plugin to a version beyond 2.5.0.
Details
- CWE(s)