CVE-2025-23770
Published: 22 January 2025
Summary
CVE-2025-23770 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious Link (T1204.001); ranked at the 29.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 requires validating information inputs to the Fast Tube plugin, directly addressing the improper neutralization of input that enables reflected XSS payloads.
SI-15 enforces filtering of web page outputs generated by the Fast Tube plugin, preventing injected scripts from executing in victims' browsers.
SI-2 mandates identification and correction of the specific flaw in Fast Tube versions through <=2.3.1, eliminating the vulnerability via patching.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS is exploited via victims visiting maliciously crafted URLs (T1204.001) and directly enables stealing web session cookies through client-side script execution (T1539).
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Caspie Fast Tube fast-tube allows Reflected XSS.This issue affects Fast Tube: from n/a through <= 2.3.1.
Deeper analysisAI
CVE-2025-23770 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Reflected Cross-site Scripting (XSS) as classified under CWE-79. It affects the Caspie Fast Tube WordPress plugin, specifically versions from n/a through 2.3.1. The issue was published on 2025-01-22T15:15:23.303 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Attackers can exploit this vulnerability remotely over the network with low attack complexity, requiring no authentication privileges but relying on user interaction, such as visiting a maliciously crafted URL. Exploitation changes the security scope, allowing limited impacts on confidentiality, integrity, and availability, such as executing arbitrary scripts in the victim's browser context to potentially steal session cookies, deface pages, or perform other client-side attacks.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/fast-tube/vulnerability/wordpress-fast-tube-plugin-2-3-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve details this Reflected XSS vulnerability in Fast Tube version 2.3.1, providing information relevant to mitigation for WordPress environments.
Details
- CWE(s)