CVE-2025-23811
Published: 22 January 2025
Summary
CVE-2025-23811 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-23811 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the WP2APP plugin (wp2appir) developed by ghasemy14 for WordPress. This issue affects the plugin from unknown initial versions through 2.6.2. The vulnerability was published on 2025-01-22 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Attackers can exploit this vulnerability remotely over the network with low attack complexity and no required privileges, though it demands user interaction such as clicking a malicious link. Exploitation results in a changed scope, enabling limited impacts on confidentiality, integrity, and availability within the victim's browser context, potentially allowing theft of session data or execution of arbitrary scripts in the user's session.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp2appir/vulnerability/wordpress-wp2app-plugin-2-6-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve documents the Reflected XSS vulnerability in WP2APP plugin version 2.6.2 and provides details on affected installations for mitigation purposes. Security practitioners should review this reference for patch availability and recommended remediation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3443
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ghasemy14 WP2APP wp2appir allows Reflected XSS.This issue affects WP2APP: from n/a through <= 2.6.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables exploitation of public-facing applications (T1190) and facilitates browser session hijacking via arbitrary script execution and session data theft (T1185).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates reflected XSS by requiring filtering of web page outputs to neutralize untrusted input and prevent script injection in the victim's browser.
Prevents exploitation of the improper input neutralization vulnerability by validating all user inputs to the WP2APP plugin before processing or reflection.
Addresses the specific flaw in WP2APP versions through 2.6.2 by requiring timely identification, testing, and deployment of patches or mitigations.