CVE-2025-25169
Published: 03 March 2025
Summary
CVE-2025-25169 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 42.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-15 requires filtering of information outputs to prevent unneutralized user input from executing malicious scripts in the context of the victim's browser during reflected XSS in the WordPress plugin.
SI-10 enforces validation of inputs to the Authors Autocomplete Meta Box, blocking malicious payloads before they are reflected in generated web pages.
SI-2 mandates identification and remediation of flaws like CVE-2025-25169, ensuring the vulnerable WordPress plugin is patched to eliminate the XSS vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin enables T1190 (explicitly includes XSS for initial access); arbitrary browser script execution directly facilitates T1539 (steal web session cookies) and T1185 (browser session hijacking).
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rachel Cherry Authors Autocomplete Meta Box authors-autocomplete-meta-box allows Reflected XSS.This issue affects Authors Autocomplete Meta Box: from n/a through <= 1.2.
Deeper analysisAI
CVE-2025-25169 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Authors Autocomplete Meta Box WordPress plugin by Rachel Cherry. The flaw affects all versions of the plugin from n/a through 1.2 inclusive. Published on 2025-03-03, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Attackers can exploit this vulnerability remotely over the network with low attack complexity and no privileges required, though it demands user interaction such as visiting a malicious link or page. Upon successful exploitation, reflected XSS enables arbitrary script execution in the context of the victim's browser on the affected site, resulting in low impacts to confidentiality, integrity, and availability, with a changed scope.
The Patchstack advisory documents this Reflected XSS vulnerability specifically in Authors Autocomplete Meta Box plugin version 1.2 for WordPress.
Details
- CWE(s)