CVE-2025-23789

High

Published: 14 February 2025

Published

14 February 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS Score 0.0013 32.1th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-23789 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2025-23789 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Reflected Cross-site Scripting (XSS) as classified under CWE-79. It affects the WordPress plugin "URL Shortener | Conversion Tracking | AB Testing | WooCommerce" by tahminajannat, also referenced in connection with easy-broken-link-checker, in all versions from n/a through 9.0.2. The vulnerability was published on 2025-02-14.

With a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the issue is exploitable remotely over the network by unauthenticated attackers with low attack complexity, though it requires user interaction such as clicking a malicious link. Successful exploitation allows reflected XSS, resulting in low impacts to confidentiality, integrity, and availability, but with changed scope that could affect other users or resources.

The Patchstack advisory documents this reflected XSS vulnerability specifically in version 9.0.2 of the WordPress URL Shortener WooCommerce plugin.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-3421

Vulnerability details

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tahminajannat URL Shortener | Conversion Tracking | AB Testing | WooCommerce easy-broken-link-checker allows Reflected XSS.This issue affects URL Shortener | Conversion Tracking | AB Testing | WooCommerce: from…

n/a through <= 9.0.2.

CWE(s): CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.007 JavaScript Execution

Adversaries may abuse various implementations of JavaScript for execution.

attack.mitre.org →

Why these techniques?

Reflected XSS in public-facing WordPress plugin directly enables exploitation of public-facing applications (T1190) and browser-based JavaScript execution (T1059.007) via malicious links.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1