CVE-2025-23852
Published: 03 March 2025
Summary
CVE-2025-23852 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 45.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly enforces validation of user inputs such as comments or redirect parameters to prevent improper neutralization leading to reflected XSS execution.
Filters web page outputs to neutralize attacker-controlled scripts reflected from untrusted inputs in the WordPress plugin.
Remediates the specific XSS flaw in the First Comment Redirect plugin by identifying, patching, and deploying updates up to version 1.0.3.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The reflected XSS vulnerability allows crafting malicious links that execute arbitrary scripts in the victim's browser upon interaction, directly facilitating drive-by compromise attacks on users of the vulnerable WordPress site.
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robin90 First Comment Redirect first-comment-redirect allows Reflected XSS.This issue affects First Comment Redirect: from n/a through <= 1.0.3.
Deeper analysisAI
CVE-2025-23852 is an improper neutralization of input during web page generation vulnerability, enabling reflected cross-site scripting (XSS) as defined by CWE-79, in the First Comment Redirect WordPress plugin developed by robin90. This issue affects the plugin from its initial release through version 1.0.3.
The vulnerability carries a CVSS v3.1 base score of 7.1 (High) with the vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. Remote attackers require no privileges and face low attack complexity but must trick users into interacting, such as via a malicious link or comment. Exploitation reflects attacker-controlled input as executable scripts in the victim's browser, with changed scope enabling low-level impacts on confidentiality, integrity, and availability, such as limited data theft or page manipulation.
Patchstack documents this vulnerability in their database for the First Comment Redirect WordPress plugin up to version 1.0.3, accessible at https://patchstack.com/database/Wordpress/Plugin/first-comment-redirect/vulnerability/wordpress-first-comment-redirect-plugin-1-0-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve. Practitioners should review the advisory for specific mitigation steps, including potential plugin updates.
Details
- CWE(s)