CVE-2025-24630
Published: 03 February 2025
Summary
CVE-2025-24630 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious Link (T1204.001); ranked at the 17.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-15 (Information Output Filtering) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-24630 is an improper neutralization of input during web page generation vulnerability, enabling reflected cross-site scripting (XSS) as classified under CWE-79, in the MantraBrain Sikshya LMS WordPress plugin. This issue affects all versions of Sikshya LMS from n/a through 0.0.21 inclusive. The vulnerability carries a CVSS v3.1 base score of 7.1, with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, and was published on 2025-02-03T15:15:27.730.
Unauthenticated attackers accessible over the network can exploit this vulnerability with low attack complexity, though it requires user interaction, such as a victim clicking a malicious link. Exploitation changes the security scope and allows limited impacts on confidentiality, integrity, and availability, typically enabling arbitrary JavaScript execution in the victim's browser context.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/sikshya/vulnerability/wordpress-sikshya-lms-plugin-0-0-21-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3831
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MantraBrain Sikshya LMS sikshya allows Reflected XSS.This issue affects Sikshya LMS: from n/a through <= 0.0.21.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The reflected XSS vulnerability is directly exploited via a malicious link requiring user interaction, enabling arbitrary JavaScript execution in the victim's browser context.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses improper neutralization of input during web page generation by requiring output filtering to prevent reflected XSS script execution in victim browsers.
Validates untrusted network inputs to block malicious XSS payloads before they are reflected in dynamically generated web pages.
Ensures timely patching and remediation of the specific XSS flaw in Sikshya LMS versions through 0.0.21 to eliminate the vulnerability.