CVE-2025-25119
Published: 03 March 2025
Summary
CVE-2025-25119 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 29.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Information Output Filtering directly prevents reflected XSS by encoding or filtering user inputs before rendering them in web pages, addressing the improper neutralization flaw in the WooCommerce osCommerce Sync plugin.
Information Input Validation enforces checks on user inputs to block malicious payloads before they are reflected in web page generation, mitigating the CWE-79 vulnerability.
Flaw Remediation requires timely identification, reporting, and patching of the specific XSS vulnerability in versions <= 2.0.20 of the woo-oscommerce-sync plugin.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS enables arbitrary JavaScript execution in browser (T1059.007) via malicious link (T1204.001) or drive-by compromise (T1189).
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alejandro Aranda Woocommerce osCommerce Sync woo-oscommerce-sync allows Reflected XSS.This issue affects Woocommerce osCommerce Sync: from n/a through <= 2.0.20.
Deeper analysisAI
CVE-2025-25119 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Reflected Cross-site Scripting (XSS) as classified under CWE-79. It affects the WooCommerce osCommerce Sync plugin (woo-oscommerce-sync) developed by Alejandro Aranda, impacting all versions from n/a through 2.0.20. Published on 2025-03-03T14:15:51.750, the vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Remote attackers without privileges can exploit this over the network with low attack complexity, though it requires user interaction, such as visiting a maliciously crafted link or page. Successful exploitation reflects attacker-controlled input in the web page, executing arbitrary JavaScript in the victim's browser context. This achieves low impacts on confidentiality, integrity, and availability, elevated by the changed scope to the site's security context.
Mitigation guidance is available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/woo-oscommerce-sync/vulnerability/wordpress-easy-wp-tiles-plugin-1-cross-site-scripting-xss-vulnerability-4?_s_id=cve.
Details
- CWE(s)