CVE-2025-23838
Published: 24 January 2025
Summary
CVE-2025-23838 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 43.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-23838 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS, CWE-79), affecting the WordPress plugin "Bauernregeln" by Rally Vincent. The issue impacts all versions from unknown initial release through 1.0.1, allowing malicious input to be reflected in dynamically generated web pages without proper sanitization.
The vulnerability can be exploited remotely over the network (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) but user interaction (UI:R), such as clicking a crafted link. Successful exploitation changes scope (S:C), enabling limited impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), for an overall CVSS v3.1 base score of 7.1 (High). Attackers could potentially execute scripts in victims' browsers to steal session data or perform actions on their behalf within the site's context.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/bauernregeln/vulnerability/wordpress-bauernregeln-plugin-1-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve, which documents the vulnerability in the Bauernregeln plugin version 1.0.1. Security practitioners should check for plugin updates beyond 1.0.1 and apply input validation or content security policies as interim measures.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3467
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rally Vincent Bauernregeln bauernregeln allows Reflected XSS.This issue affects Bauernregeln: from n/a through <= 1.0.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables T1190 (exploiting the app remotely), T1059.007 (arbitrary JavaScript execution in browser), T1185 (browser session hijacking), and T1539 (stealing web session cookies/session data).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-15 requires filtering of information outputs, directly preventing reflected XSS by neutralizing unsanitized user inputs before they are rendered in dynamically generated web pages.
SI-10 enforces validation of information inputs, blocking malicious payloads from being accepted and reflected by the vulnerable Bauernregeln WordPress plugin.
SI-2 mandates identification and remediation of system flaws, enabling patching of the Bauernregeln plugin beyond version 1.0.1 to eliminate the XSS vulnerability.