CVE-2025-23755
Published: 03 February 2025
Summary
CVE-2025-23755 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-23755 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-Site Scripting (XSS) under CWE-79, affecting the PAFacile WordPress plugin developed by tosend.it. The issue impacts all versions of PAFacile up to and including 2.6.1. It has a CVSS v3.1 base score of 7.1, reflecting network accessibility, low attack complexity, no required privileges, user interaction, changed scope, and low impacts on confidentiality, integrity, and availability.
Attackers can exploit this vulnerability remotely without authentication by crafting malicious input that is reflected in web page generation, tricking users into interacting with it, such as clicking a specially crafted link. Successful exploitation enables execution of arbitrary scripts in the victim's browser context, potentially leading to session hijacking, data theft, or further site compromise, though impacts remain low across affected triad categories due to the reflected nature and scope change.
Patchstack advisories document this vulnerability in their WordPress plugin database, highlighting the Reflected XSS in PAFacile version 2.6.1 and earlier, with mitigation guidance available via their vulnerability entry at https://patchstack.com/database/Wordpress/Plugin/pafacile/vulnerability/wordpress-pafacile-plugin-2-6-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3392
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tosend.it PAFacile pafacile allows Reflected XSS.This issue affects PAFacile: from n/a through <= 2.6.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a reflected XSS vulnerability in a public-facing WordPress plugin, directly enabling remote exploitation of public-facing applications without authentication via crafted links that reflect malicious input.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-15 directly mitigates reflected XSS by requiring filtering or encoding of information output during web page generation to prevent injection of malicious scripts.
SI-10 enforces comprehensive input validation to neutralize or reject malicious payloads before they are reflected in web pages.
SI-2 ensures timely identification, reporting, and patching of the specific flaw in PAFacile versions up to 2.6.1.