CVE-2025-25099
Published: 03 March 2025
Summary
CVE-2025-25099 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 45.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires identification, reporting, and correction of the specific XSS flaw in the Appointment Buddy Widget plugin through timely patching.
Mandates filtering of information outputs during web page generation to neutralize untrusted input and prevent XSS script injection.
Enforces validation of user inputs to the WordPress plugin, blocking malicious payloads that could lead to XSS exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
XSS in public-facing WordPress plugin enables drive-by compromise via injected malicious scripts (T1189) and stealing web session cookies through arbitrary browser script execution (T1539).
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in accreteinfosolution Appointment Buddy Widget appointment-buddy-online-appointment-booking-by-accrete allows Cross-Site Scripting (XSS).This issue affects Appointment Buddy Widget: from n/a through <= 1.2.
Deeper analysisAI
CVE-2025-25099 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Cross-Site Scripting (XSS) under CWE-79, affecting the WordPress plugin Appointment Buddy Widget (appointment-buddy-online-appointment-booking-by-accrete) from accreteinfosolution. The issue impacts all versions from n/a through 1.2 inclusive.
With a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the vulnerability can be exploited by remote attackers requiring no privileges over the network with low attack complexity, though it demands user interaction. Exploitation enables arbitrary script execution in the victim's browser context, achieving low impacts on confidentiality, integrity, and availability while changing scope to affect other users or resources.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/appointment-buddy-online-appointment-booking-by-accrete/vulnerability/wordpress-embed-rss-plugin-3-1-arbitrary-shortcode-execution-vulnerability?_s_id=cve.
Details
- CWE(s)