CVE-2025-23905
Published: 14 February 2025
Summary
CVE-2025-23905 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates reflected XSS by filtering information outputs during web page generation to neutralize malicious scripts in admin pages.
Validates inputs to the Admin Options Pages plugin, preventing improper neutralization of malicious input that leads to XSS.
Remediates the specific flaw in WordPress Admin Options Pages plugin versions through <=0.9.7 by identifying and applying patches promptly.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in WordPress admin plugin enables script injection/execution in authenticated user's browser via crafted URL, directly facilitating public-facing web app exploitation (T1190) and browser session hijacking (T1185).
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Johannes van Poelgeest Admin Options Pages admin-options-pages allows Reflected XSS.This issue affects Admin Options Pages: from n/a through <= 0.9.7.
Deeper analysisAI
CVE-2025-23905 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Admin Options Pages WordPress plugin developed by Johannes van Poelgeest. The flaw affects all versions of the plugin from an unspecified initial release through 0.9.7.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, and user interaction needed, with changed scope and low impacts on confidentiality, integrity, and availability. Remote attackers can exploit it by tricking authenticated users, such as site administrators, into interacting with maliciously crafted input reflected in admin pages, potentially leading to script execution in the victim's browser context.
Mitigation guidance is available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/admin-options-pages/vulnerability/wordpress-admin-options-pages-plugin-0-9-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve, which details the Reflected XSS issue in version 0.9.7.
Details
- CWE(s)