CVE-2025-25170
Published: 03 March 2025
Summary
CVE-2025-25170 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious Link (T1204.001); ranked in the top 42.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires filtering and encoding of information outputs to neutralize untrusted input reflected in web pages, directly preventing execution of XSS payloads in users' browsers.
Mandates validation of all inputs to the system, blocking malicious scripts from being accepted and reflected in the vulnerable WordPress plugin.
Ensures timely identification and remediation of the specific flaw in the Migrate Posts plugin enabling reflected XSS exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS enables delivery of malicious links that trigger arbitrary JavaScript execution in the victim's browser upon user interaction.
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DotsquaresLtd Migrate Posts migrate-post allows Reflected XSS.This issue affects Migrate Posts: from n/a through <= 1.0.
Deeper analysisAI
CVE-2025-25170 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the DotsquaresLtd Migrate Posts (migrate-post) WordPress plugin. This issue affects all versions from n/a through 1.0 inclusive, as published on 2025-03-03.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, and user interaction needed for exploitation. Remote attackers without authentication can deliver malicious payloads via reflected input, potentially executing scripts in the context of affected users' browsers with changed scope, leading to low impacts on confidentiality, integrity, and availability.
Patchstack provides details on this post-based XSS vulnerability in the Migrate Posts plugin version 1.0 via its database advisory at https://patchstack.com/database/Wordpress/Plugin/migrate-post/vulnerability/wordpress-migrate-posts-plugin-1-0-post-based-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)