CVE-2025-23736
Published: 03 March 2025
Summary
CVE-2025-23736 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious Link (T1204.001); ranked in the top 42.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-23736 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the webgdawg Form To JSON WordPress plugin (form-to-json). This issue affects all versions from n/a through 1.0 inclusive. Published on 2025-03-03, it carries a CVSS v3.1 base score of 7.1.
Attackers can exploit this vulnerability remotely over the network (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) but user interaction (UI:R), such as clicking a malicious link. The changed scope (S:C) enables script execution in the victim's browser context, resulting in low impacts to confidentiality, integrity, and availability (C:L/I:L/A:L). Potential outcomes include session hijacking, data theft, or further site compromise within the user's session.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/form-to-json/vulnerability/wordpress-form-to-json-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve) documents this Reflected XSS vulnerability in the Form To JSON WordPress plugin version 1.0.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5700
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webgdawg Form To JSON form-to-json allows Reflected XSS.This issue affects Form To JSON: from n/a through <= 1.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS enables arbitrary JavaScript execution in the victim's browser when a user clicks a crafted malicious link containing the payload, directly facilitating user execution via malicious link and JavaScript scripting.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses improper neutralization during web page generation by filtering outputs to prevent execution of reflected XSS scripts in the victim's browser.
Validates user inputs to block malicious XSS payloads from being processed and reflected by the Form To JSON WordPress plugin.
Remediates the specific reflected XSS flaw in the plugin through timely patching or compensating controls to prevent exploitation.