CVE-2025-23959
Published: 22 January 2025
Summary
CVE-2025-23959 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-23959 is an improper neutralization of input during web page generation vulnerability, enabling reflected cross-site scripting (XSS) as classified under CWE-79. It affects the Good Old Gallery WordPress plugin by Linus Lundahl, with the issue present in all versions from n/a through 2.1.2. Published on 2025-01-22, the vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), reflecting its high severity due to network accessibility, low complexity, lack of required privileges, user interaction requirement, and changed scope.
The vulnerability can be exploited by unauthenticated attackers over the network with low attack complexity. Exploitation typically involves tricking a user into interacting with a maliciously crafted link or input that gets reflected unsanitized into the web page. This allows attackers to execute arbitrary scripts in the victim's browser context, achieving low impacts on confidentiality (e.g., potential session data exposure), integrity (e.g., minor data manipulation), and availability, amplified by the cross-origin scope change.
The primary advisory from Patchstack, available at https://patchstack.com/database/Wordpress/Plugin/good-old-gallery/vulnerability/wordpress-good-old-gallery-plugin-2-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve, details the vulnerability in the context of the WordPress plugin. Security practitioners should review this reference for mitigation guidance, such as applying available patches or updates to affected versions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3569
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Linus Lundahl Good Old Gallery good-old-gallery allows Reflected XSS.This issue affects Good Old Gallery: from n/a through <= 2.1.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a reflected XSS in a public-facing WordPress plugin, directly enabling exploitation of public-facing applications (T1190) and execution of arbitrary JavaScript in the victim's browser (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates reflected XSS by filtering output to web pages, preventing unsanitized malicious input from executing scripts in the victim's browser.
Enforces validation of inputs to the WordPress plugin, blocking or transforming malicious payloads before they are reflected in web page generation.
Requires timely remediation of the known flaw in Good Old Gallery plugin versions <=2.1.2 through patching or updates to eliminate the XSS vulnerability.