CVE-2025-23741
Published: 03 March 2025
Summary
CVE-2025-23741 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 42.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Information output filtering directly neutralizes attacker-controlled input reflected as executable script in web pages, comprehensively mitigating this reflected XSS vulnerability.
Information input validation checks and sanitizes user inputs to prevent malicious scripts from being processed by the WordPress plugin.
Flaw remediation requires identifying and patching the specific XSS vulnerability in the Notifications Center plugin versions up to 1.5.2.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin enables exploitation of Internet-facing web apps (T1190) to execute attacker-controlled scripts in victim browser (T1203).
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Florian Chaillou Notifications Center notifications-center allows Reflected XSS.This issue affects Notifications Center: from n/a through <= 1.5.2.
Deeper analysisAI
CVE-2025-23741 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Notifications Center WordPress plugin by Florian Chaillou. The issue affects all versions of the notifications-center plugin from its initial release (n/a) through 1.5.2 inclusive. Published on 2025-03-03, it carries a CVSS v3.1 base score of 7.1.
Unauthenticated remote attackers can exploit this vulnerability over the network with low complexity and no required privileges, but it necessitates user interaction such as clicking a malicious link. Successful exploitation reflects attacker-controlled input as executable script in the victim's browser context, with a changed scope enabling potential impacts beyond the targeted user. This results in low confidentiality, integrity, and availability effects as scored.
The Patchstack advisory provides details on this WordPress plugin vulnerability, including assessment and recommended actions for mitigation, accessible at https://patchstack.com/database/Wordpress/Plugin/notifications-center/vulnerability/wordpress-notifications-center-plugin-1-5-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)