CVE-2025-23836
Published: 23 January 2025
Summary
CVE-2025-23836 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious Link (T1204.001); ranked at the 39.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-23836 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Custom Coming Soon WordPress plugin by SuryaBhan. This issue affects all versions of the custom-coming-soon plugin from n/a through 2.2 inclusive. The vulnerability was published on 2025-01-23 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Attackers can exploit this reflected XSS vulnerability remotely over the network with low attack complexity and no required privileges, though it demands user interaction such as clicking a malicious link. Upon successful exploitation, adversaries achieve limited impacts on confidentiality, integrity, and availability with a changed scope, enabling client-side effects like session hijacking, data exfiltration from the victim's browser, or unauthorized actions within the site's context.
The Patchstack advisory provides details on mitigation, available at https://patchstack.com/database/Wordpress/Plugin/custom-coming-soon/vulnerability/wordpress-custom-coming-soon-plugin-2-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3465
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SuryaBhan Custom Coming Soon custom-coming-soon allows Reflected XSS.This issue affects Custom Coming Soon: from n/a through <= 2.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The reflected XSS vulnerability in a public-facing WordPress plugin is exploited via malicious links requiring user interaction (T1204.001), directly enabling browser session hijacking (T1185) and data exfiltration from the victim's browser over a C2 channel (T1041) as described in the client-side impacts.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents reflected XSS by filtering malicious scripts from untrusted user inputs during web page generation in the Custom Coming Soon plugin.
Mitigates the improper neutralization vulnerability by validating and sanitizing user inputs to block XSS payloads before reflection.
Addresses the specific flaw in the plugin by requiring timely identification, reporting, and patching of the reflected XSS vulnerability.