CVE-2025-23752
Published: 27 January 2025
Summary
CVE-2025-23752 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-15 (Information Output Filtering) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-15 requires filtering of information outputs to neutralize malicious input during web page generation, directly preventing reflected XSS exploitation.
SI-10 enforces validation of information inputs, blocking malicious payloads from being accepted and reflected in web pages.
SI-2 mandates timely flaw remediation, such as patching the vulnerable WordPress plugin to eliminate the XSS vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin enables remote exploitation of the web app via crafted malicious URL requiring user click (T1190, T1204.001) to execute arbitrary JavaScript in browser context.
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Clifton Griffin CGD Arrange Terms shopp-arrange allows Reflected XSS.This issue affects CGD Arrange Terms: from n/a through <= 1.1.3.
Deeper analysisAI
CVE-2025-23752 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the CGD Arrange Terms (shopp-arrange) WordPress plugin by Clifton Griffin. The issue affects all versions from n/a through 1.1.3, allowing malicious input to be reflected without proper sanitization during web page generation.
A remote attacker with network access can exploit this vulnerability without authentication privileges by crafting a malicious URL that requires user interaction, such as clicking a link. With a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), exploitation is of low complexity and changes the scope, enabling low-level impacts on confidentiality, integrity, and availability in the victim's browser context, such as script execution leading to session hijacking or data theft.
The Patchstack advisory provides further details on this WordPress plugin vulnerability, including assessment and potential mitigation steps, accessible at https://patchstack.com/database/Wordpress/Plugin/shopp-arrange/vulnerability/wordpress-cgd-arrange-terms-plugin-1-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)