CVE-2025-24629
Published: 03 February 2025
Summary
CVE-2025-24629 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 17.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates reflected XSS by filtering information output to web pages, preventing execution of malicious JavaScript from unneutralized user input.
Validates and sanitizes inputs to the WordPress plugin, blocking malicious payloads before they are reflected in generated web pages.
Remediates the specific flaw in gf-excel-import plugin versions <=1.18 by applying patches or removing vulnerable components.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS enables arbitrary JavaScript execution in the victim's browser (T1059.007) which directly facilitates stealing web session cookies (T1539) and browser session hijacking (T1185) as described in the CVE.
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpgear Import Excel to Gravity Forms gf-excel-import allows Reflected XSS.This issue affects Import Excel to Gravity Forms: from n/a through <= 1.18.
Deeper analysisAI
CVE-2025-24629 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the WordPress plugin Import Excel to Gravity Forms (gf-excel-import) by wpgear. This issue affects the plugin from unknown initial versions through version 1.18 inclusive.
The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating it is exploitable over the network with low attack complexity, no privileges required, but user interaction needed. Remote attackers can craft malicious payloads that reflect user input without proper neutralization, tricking victims—such as site administrators or logged-in users—into accessing a malicious link or page, such as via phishing. Exploitation executes arbitrary JavaScript in the victim's browser context, enabling theft of session tokens or sensitive data, with changed scope potentially impacting the site's security.
Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/gf-excel-import/vulnerability/wordpress-import-excel-to-gravity-forms-plugin-1-18-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve documents the Reflected XSS in version 1.18, urging WordPress administrators to update the plugin or apply available mitigations to prevent exploitation.
Details
- CWE(s)