CVE-2025-26583
Published: 26 March 2025
Summary
CVE-2025-26583 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 29.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-26583 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the videowhisper Video Share VOD WordPress plugin (video-share-vod). This issue affects all versions from n/a through 2.7.9.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Remote attackers require no privileges or authentication and can exploit it over the network with low attack complexity, though it demands user interaction such as clicking a malicious link. Exploitation enables limited impacts on confidentiality, integrity, and availability within a changed security scope, typically allowing execution of arbitrary scripts in the victim's browser context.
Patchstack provides details on the vulnerability and mitigation in its advisory at https://patchstack.com/database/Wordpress/Plugin/video-share-vod/vulnerability/wordpress-video-share-vod-plugin-2-6-32-reflected-cross-site-scripting-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8162
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in videowhisper Video Share VOD video-share-vod allows Reflected XSS.This issue affects Video Share VOD: from n/a through <= 2.7.9.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS directly enables arbitrary JavaScript execution in the victim's browser (T1059.007) and is triggered via user interaction with a malicious link (T1204.001).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates reflected XSS by filtering web page outputs to neutralize untrusted input and prevent script injection in the victim's browser.
Prevents reflected XSS exploitation by validating user inputs to the Video Share VOD plugin, blocking malicious payloads before reflection.
Addresses the root cause of CVE-2025-26583 by requiring timely identification, reporting, and patching of the improper input neutralization flaw in affected plugin versions.