CVE-2025-25142
Published: 03 March 2025
Summary
CVE-2025-25142 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Filters output to web pages to directly prevent stored XSS attacks by neutralizing malicious scripts before rendering.
Validates and neutralizes user inputs to the WP Less Compiler plugin, preventing storage of malicious payloads that enable stored XSS.
Requires timely patching or removal of the vulnerable WP Less Compiler plugin versions through 1.3.0 to remediate the specific XSS flaw.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public-facing WordPress plugin directly enables remote exploitation of the web app (T1190), facilitates drive-by compromise via malicious page content (T1189), and supports browser session hijacking through script execution to steal session data (T1185).
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Jake Group WP Less Compiler wp-less-compiler allows Stored XSS.This issue affects WP Less Compiler: from n/a through <= 1.3.0.
Deeper analysisAI
CVE-2025-25142 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Stored Cross-site Scripting (XSS) as classified under CWE-79, in the WP Less Compiler plugin (wp-less-compiler) developed by The Jake Group for WordPress. This issue affects all versions of the plugin from its initial release through 1.3.0 inclusive. The vulnerability was published on 2025-03-03 with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Unauthenticated attackers with network access can exploit this vulnerability by submitting malicious input that gets stored and reflected in generated web pages, though it requires user interaction such as a victim viewing the affected page. Exploitation changes scope and allows limited impacts on confidentiality, integrity, and availability, potentially enabling script execution in the victim's browser context to steal session data or perform other actions within the site's permissions.
The Patchstack advisory provides details on this vulnerability, including recommendations for mitigation, accessible at https://patchstack.com/database/Wordpress/Plugin/wp-less-compiler/vulnerability/wordpress-wp-less-compiler-plugin-1-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)