CVE-2025-23847
Published: 03 March 2025
Summary
CVE-2025-23847 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 45.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-15 requires filtering information prior to output to web pages, directly neutralizing reflected user inputs to prevent XSS script execution in the victim's browser.
SI-10 mandates validation of information inputs at system interfaces, rejecting or sanitizing malicious payloads like those exploited in this reflected XSS vulnerability.
SI-2 ensures identification, reporting, and correction of flaws such as the improper input neutralization in the Site Launcher plugin, preventing exploitation through timely remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS enables arbitrary JS execution in browser via crafted malicious URL (facilitates T1189 Drive-by Compromise); explicitly supports session hijacking via cookie theft (T1539 Steal Web Session Cookie).
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in saill Site Launcher site-launcher allows Reflected XSS.This issue affects Site Launcher: from n/a through <= 0.9.4.
Deeper analysisAI
CVE-2025-23847 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79. It affects the Site Launcher WordPress plugin, also referred to as saill Site Launcher site-launcher, in all versions up to and including 0.9.4.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Remote attackers with no privileges can exploit it over the network with low attack complexity by tricking authenticated users into performing actions such as visiting a malicious URL or submitting crafted input that gets reflected unsanitized on the page. Exploitation executes arbitrary JavaScript in the victim's browser context with changed scope, enabling limited impacts on confidentiality, integrity, and availability, such as session hijacking or data exfiltration.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/site-launcher/vulnerability/wordpress-site-launcher-plugin-0-9-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve) documents this Reflected XSS issue specifically in Site Launcher version 0.9.4.
Details
- CWE(s)