CVE-2025-25102
Published: 03 March 2025
Summary
CVE-2025-25102 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked in the top 42.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-15 (Information Output Filtering) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-25102 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Yahoo BOSS WordPress plugin developed by Josh Harrison (yahoo-boss package). This issue affects all versions from n/a through <= 0.7. Published on 2025-03-03, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Remote attackers can exploit this vulnerability over the network with low complexity and no privileges required, though it necessitates user interaction such as clicking a malicious link. Successful exploitation enables reflected XSS, where attacker-controlled input is reflected unsanitized in the web page, allowing script injection in the victim's browser context. The changed scope (S:C) results in low impacts to confidentiality, integrity, and availability, potentially compromising user session data.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/yahoo-boss/vulnerability/wordpress-yahoo-boss-plugin-0-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve documents this reflected XSS vulnerability in the WordPress Yahoo BOSS plugin version 0.7. Security practitioners should consult this reference for additional details on affected installations and recommended mitigations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5664
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh Harrison Yahoo BOSS yahoo-boss allows Reflected XSS.This issue affects Yahoo BOSS: from n/a through <= 0.7.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS enables script injection in victim's browser context, directly facilitating browser session hijacking (T1185) and stealing web session cookies (T1539) to compromise session data.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-15 mandates filtering information prior to output to web pages, directly preventing reflected XSS by neutralizing unsanitized attacker input during page generation.
SI-10 requires validation of information inputs, addressing one aspect of the CVE by rejecting or sanitizing malicious payloads before they are reflected.
SI-2 ensures timely flaw remediation, such as patching the vulnerable Yahoo BOSS WordPress plugin versions <=0.7 to eliminate the XSS vulnerability.