CVE-2025-26991
Published: 25 February 2025
Summary
CVE-2025-26991 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious Link (T1204.001); ranked at the 29.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses reflected XSS by filtering and encoding information output during web page generation to block script execution.
Validates and sanitizes untrusted user inputs to the WPPizza plugin, preventing malicious payloads from being reflected in web pages.
Ensures timely remediation of the specific flaw in WPPizza versions through <=3.19.4 by applying patches or workarounds.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS enables exploitation via malicious link (T1204.001), arbitrary JavaScript execution in browser (T1059.007), browser session hijacking (T1185), and stealing web session cookies (T1539).
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ollybach WPPizza wppizza allows Reflected XSS.This issue affects WPPizza: from n/a through <= 3.19.4.
Deeper analysisAI
CVE-2025-26991 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Reflected Cross-site Scripting (XSS) as classified under CWE-79. It affects the WPPizza WordPress plugin developed by ollybach, impacting all versions from n/a through 3.19.4.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), meaning unauthenticated attackers can exploit it remotely with low complexity by tricking users into interacting with a malicious link or payload. Successful exploitation reflects attacker-controlled input into the web page, executing arbitrary scripts in the victim's browser within the site's context, potentially leading to session hijacking, data theft, or site defacement with low impacts on confidentiality, integrity, and availability due to the changed scope.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wppizza/vulnerability/wordpress-wppizza-plugin-3-19-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve details the issue and should be consulted for mitigation guidance, including any available patches or workarounds for affected WPPizza installations.
Details
- CWE(s)