CVE-2025-23744
Published: 15 March 2025
Summary
CVE-2025-23744 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-23744 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the WordPress plugin Random Posts, Mp3 Player + ShareButton by dvs11. This issue affects all versions of the plugin from unknown initial release through 1.4.1. The vulnerability was published on 2025-03-15 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility and scope change.
Attackers can exploit this Reflected XSS remotely over the network with low attack complexity and no privileges required, though successful exploitation depends on user interaction, such as a victim clicking a malicious link or interacting with crafted input that gets reflected unsanitized into the web page. This allows limited impacts on confidentiality, integrity, and availability within a changed security scope, potentially enabling theft of user session data, defacement, or further phishing within the site's context.
Patchstack advisories detail the Reflected XSS vulnerability specifically in the random-posts-mp3-player-sharebutton WordPress plugin up to version 1.4.1, providing analysis for mitigation guidance. Security practitioners should consult the referenced advisory at https://patchstack.com/database/Wordpress/Plugin/random-posts-mp3-player-sharebutton/vulnerability/wordpress-random-posts-mp3-player-sharebutton-plugin-1-4-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve for recommended actions, such as plugin updates or removal if no patch is available.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6634
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dvs11 Random Posts, Mp3 Player + ShareButton random-posts-mp3-player-sharebutton allows Reflected XSS.This issue affects Random Posts, Mp3 Player + ShareButton: from n/a through <= 1.4.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin enables T1190 (exploiting public-facing apps for initial access) and T1185 (browser session hijacking via script injection to steal cookies).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires filtering user input prior to inclusion in web pages, directly preventing reflected XSS by neutralizing malicious scripts during web page generation.
Mandates validation of information inputs for correctness and completeness before processing, blocking XSS payloads from being accepted and reflected.
Ensures timely identification, reporting, and correction of flaws like this plugin vulnerability through patching or removal.