CVE-2025-24635
Published: 31 January 2025
Summary
CVE-2025-24635 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-24635 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, affecting the Paytm Payment Donation WordPress plugin (paytm-donation) in all versions up to and including 2.3.1. Published on 2025-01-31, the issue resides in the integrationdevpaytm component and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Attackers can exploit this vulnerability remotely over the network with low complexity and no required privileges, though it demands user interaction such as clicking a malicious link. Successful exploitation enables reflected XSS, allowing attackers to inject and execute arbitrary scripts in the victim's browser context, potentially compromising low-level confidentiality, integrity, and availability with a changed scope.
The Patchstack advisory details this Reflected XSS vulnerability in the WordPress Paytm Donation plugin up to version 2.3.1, serving as the primary reference for security practitioners monitoring the issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3836
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in integrationdevpaytm Paytm Payment Donation paytm-donation allows Reflected XSS.This issue affects Paytm Payment Donation: from n/a through <= 2.3.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin exploited remotely via crafted malicious link requiring user interaction (UI:R), directly enabling T1190 for public-facing app exploitation and T1566.002/T1204.001 for phishing/user execution delivery vectors.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validation of information inputs, directly preventing the improper neutralization of input that enables reflected XSS payloads in the Paytm Donation plugin.
SI-15 mandates filtering of information outputs during web page generation, comprehensively mitigating the reflected XSS vulnerability by neutralizing scripts before rendering.
SI-2 ensures identification, reporting, and correction of the specific flaw in Paytm Donation versions up to 2.3.1, eliminating the root cause of the XSS vulnerability.