CVE-2025-24641
Published: 14 February 2025
Summary
CVE-2025-24641 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-24641 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Stored Cross-site Scripting (XSS) under CWE-79, in the Better WishList API (better-wlm-api) WordPress plugin developed by rickonline_nl. This issue affects all versions of the plugin from n/a through 1.1.3 inclusive. The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility with low complexity but requiring user interaction.
An unauthenticated remote attacker can exploit this Stored XSS flaw by injecting malicious payloads into plugin inputs that are insufficiently sanitized and stored persistently. When authenticated users or administrators view affected pages, the payload executes in their browser context due to the changed scope (S:C), potentially enabling actions such as session hijacking, data theft, or further site compromise, with low impacts on confidentiality, integrity, and availability.
The Patchstack advisory documents this Stored XSS vulnerability specifically in the WordPress Better Wishlist API plugin up to version 1.1.3, providing details on the issue at https://patchstack.com/database/Wordpress/Plugin/better-wlm-api/vulnerability/wordpress-better-wishlist-api-plugin-1-1-3-stored-cross-site-scripting-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3840
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rickonline_nl Better WishList API better-wlm-api allows Stored XSS.This issue affects Better WishList API: from n/a through <= 1.1.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public-facing WordPress plugin enables remote exploitation of the web application (T1190) and client-side JavaScript execution in browsers (T1059.007) for impacts like session hijacking.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly enforces information input validation to neutralize malicious payloads before storage, addressing the improper neutralization root cause of this stored XSS vulnerability.
SI-15 requires output filtering to prevent execution of stored malicious scripts in users' browsers when viewing affected web pages.
SI-2 mandates timely flaw remediation, including patching the Better WishList API plugin versions up to 1.1.3 vulnerable to this stored XSS.