CVE-2025-26914
Published: 03 March 2025
Summary
CVE-2025-26914 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the reflected XSS flaw in the Variable Inspector WordPress plugin by identifying, reporting, and applying timely patches or updates.
Filters information output to web pages to neutralize malicious scripts reflected from untrusted inputs in the plugin.
Validates inputs to the plugin to prevent acceptance and reflection of malicious XSS payloads.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables T1190 (exploit public-facing app), T1059.007 (arbitrary JavaScript execution in browser), and T1204.001 (malicious link delivery requiring user interaction).
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bowo Variable Inspector variable-inspector allows Reflected XSS.This issue affects Variable Inspector: from n/a through <= 2.6.2.
Deeper analysisAI
CVE-2025-26914 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, affecting the Bowo Variable Inspector WordPress plugin (variable-inspector). This issue impacts all versions up to and including 2.6.2. The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and was published on 2025-03-03T14:15:56.500.
The vulnerability can be exploited by any network-accessible attacker with low attack complexity and no privileges required, though it demands user interaction such as visiting a maliciously crafted link or page. Successful exploitation enables reflected XSS, allowing arbitrary script execution in the victim's browser context with a changed scope, resulting in low impacts to confidentiality, integrity, and availability.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/variable-inspector/vulnerability/wordpress-variable-inspector-plugin-2-6-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)