CVE-2025-26874
Published: 27 March 2025
Summary
CVE-2025-26874 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 34.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-15 (Information Output Filtering) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates this CVE by requiring identification, reporting, and patching of the flaw in the MemberSpace WordPress plugin to versions beyond 2.1.13.
Prevents reflected XSS exploitation by filtering user-supplied input prior to outputting it in web page generation within the MemberSpace plugin.
Addresses the improper neutralization aspect by validating inputs to the web application, reducing the risk of malicious script injection via crafted URLs.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS directly enables arbitrary JavaScript execution in the browser (T1059.007) and facilitates session cookie theft (T1539) leading to browser session hijacking (T1185) via crafted malicious URLs.
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in memberspace MemberSpace memberspace allows Reflected XSS.This issue affects MemberSpace: from n/a through <= 2.1.13.
Deeper analysisAI
CVE-2025-26874 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Reflected Cross-Site Scripting (XSS) as classified under CWE-79. It affects the MemberSpace WordPress plugin, with all versions through 2.1.13 vulnerable. The issue was published on 2025-03-27 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Attackers can exploit this vulnerability remotely over the network with low attack complexity, requiring no privileges but relying on user interaction, such as visiting a maliciously crafted URL. Exploitation changes the security scope, allowing limited impacts on confidentiality, integrity, and availability, typically enabling theft of session cookies, impersonation of authenticated users, or execution of arbitrary scripts in the victim's browser context.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/memberspace/vulnerability/wordpress-memberspace-plugin-2-1-13-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve) documents the Reflected XSS issue in MemberSpace plugin version 2.1.13 for WordPress, recommending updates to a version beyond 2.1.13 to mitigate the vulnerability.
Details
- CWE(s)