CVE-2025-24609
Published: 31 January 2025
Summary
CVE-2025-24609 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 39.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-24609 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-Site Scripting (XSS) under CWE-79, affecting the PORTONE 우커머스 결제 iamport-for-woocommerce WordPress plugin. This issue impacts all versions of the plugin up to and including 3.2.4. The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges, user interaction requirement, and changed scope with low impacts on confidentiality, integrity, and availability.
Attackers can exploit this Reflected XSS vulnerability remotely without authentication by tricking authenticated users, such as site administrators or logged-in visitors, into interacting with maliciously crafted links or inputs that reflect executable scripts back in the web page response. Successful exploitation allows attackers to execute arbitrary JavaScript in the victim's browser context, potentially leading to session hijacking, theft of sensitive data like cookies or tokens, or further phishing attacks, though impacts are limited to low levels across confidentiality, integrity, and availability due to the changed scope.
Patchstack advisories document this vulnerability in detail for the iamport-for-woocommerce plugin version 3.2.4 and earlier, providing vulnerability intelligence for WordPress environments. Security practitioners should update to a patched version beyond 3.2.4 if available, or apply input sanitization workarounds, while monitoring for plugin updates from the vendor.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3813
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PORTONE PORTONE 우커머스 결제 iamport-for-woocommerce allows Reflected XSS.This issue affects PORTONE 우커머스 결제: from n/a through <= 3.2.4.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS enables arbitrary JS execution in browser context, directly facilitating browser session hijacking (T1185) and theft of web session cookies/tokens (T1539) via malicious links.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires filtering of information prior to output to prevent execution of reflected malicious scripts in web page responses.
Mandates validation of inputs to the system to neutralize untrusted data that could lead to reflected XSS exploitation.
Directly addresses flaw remediation by requiring identification, reporting, and correction of the specific XSS vulnerability in the iamport-for-woocommerce plugin.