CVE-2025-23756

High

Published: 27 January 2025

Published

27 January 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS Score 0.0023 46.2th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-23756 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 46.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2025-23756 is a reflected cross-site scripting (XSS) vulnerability stemming from improper neutralization of input during web page generation, classified under CWE-79. It affects the LawPress – Law Firm Website Management WordPress plugin by ivanchernyakov, impacting all versions from n/a through 1.4.5 inclusive. The issue was published on 2025-01-27 with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to network accessibility, low attack complexity, and scope change despite requiring user interaction.

A remote, unauthenticated attacker can exploit this vulnerability by crafting malicious input that is reflected back in the web page without proper sanitization, tricking victims into accessing a malicious URL via social engineering, such as phishing links. Upon execution in the victim's browser context, the injected script can achieve limited impacts: low confidentiality (e.g., potential session token theft), low integrity (e.g., minor page manipulation), and low availability (e.g., resource consumption), elevated by the changed scope to other resources.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/lawpress/vulnerability/wordpress-lawpress-plugin-1-4-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve, which documents the vulnerability in the WordPress LawPress plugin up to version 1.4.5. Security practitioners should update to a patched version if available and apply general XSS protections like content security policy (CSP) headers.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-3393

Vulnerability details

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ivanchernyakov LawPress – Law Firm Website Management lawpress allows Reflected XSS.This issue affects LawPress – Law Firm Website Management: from n/a through <= 1.4.5.

CWE(s): CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1185 Browser Session Hijacking Collection

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.

attack.mitre.org →

T1539 Steal Web Session Cookie Credential Access

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.

attack.mitre.org →

Why these techniques?

Reflected XSS enables injection of JS to steal session cookies (T1539) and hijack browser sessions (T1185) when victims visit crafted URLs.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1