CVE-2025-26573
Published: 26 March 2025
Summary
CVE-2025-26573 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 49.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses improper neutralization of input by enforcing validation of guestbook user inputs to block malicious scripts.
Prevents reflected XSS by filtering and encoding information outputs generated from untrusted user inputs in web pages.
Mitigates the specific flaw in Rizzi Guestbook <=4.0.1 through timely identification, reporting, and patching of the vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS allows arbitrary JavaScript execution in victim's browser, directly enabling T1059.007 (JavaScript), T1185 (Browser Session Hijacking), T1539 (Steal Web Session Cookie), and T1550.004 (Web Session Cookie) as described in the CVE impacts.
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JamRizzi Technologies Rizzi Guestbook rizzi-guestbook allows Reflected XSS.This issue affects Rizzi Guestbook: from n/a through <= 4.0.1.
Deeper analysisAI
CVE-2025-26573 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, affecting the Rizzi Guestbook plugin (rizzi-guestbook) from JamRizzi Technologies. This WordPress plugin is vulnerable in all versions from n/a through 4.0.1 inclusive. The issue was published on 2025-03-26 with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Attackers can exploit this remotely over the network with low complexity and no required privileges, but it necessitates user interaction, such as clicking a malicious link. Upon successful exploitation, arbitrary JavaScript executes in the context of the targeted user's browser due to the changed scope (S:C), potentially enabling limited impacts on confidentiality, integrity, and availability, such as stealing session cookies or performing actions on behalf of the victim.
The primary advisory reference is from Patchstack, detailing the XSS vulnerability in the WordPress Rizzi Guestbook plugin up to version 4.0.1. Security practitioners should review this source for specific mitigation recommendations, including any available patches or workarounds.
Details
- CWE(s)