CVE-2025-27352
Published: 24 February 2025
Summary
CVE-2025-27352 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-27352 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Stored Cross-site Scripting (XSS) under CWE-79, in the WordPress plugin "无觅相关文章插件 wumii-related-posts" developed by the wumii team. This issue affects all versions of the plugin from unknown initial release through 1.0.5.7.
Unauthenticated attackers can exploit this vulnerability over the network with low complexity and no required privileges, though it requires user interaction. As indicated in the referenced advisory, exploitation involves CSRF leading to stored XSS, enabling attackers to inject malicious scripts that execute in the context of other site users, resulting in low impacts to confidentiality, integrity, and availability with a changed scope, for a CVSS v3.1 base score of 7.1.
The Patchstack advisory provides further details on the vulnerability, including mitigation recommendations, at https://patchstack.com/database/Wordpress/Plugin/wumii-related-posts/vulnerability/wordpress-plugin-1-0-5-7-csrf-to-cross-site-scripting-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4315
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wumii team 无觅相关文章插件 wumii-related-posts allows Stored XSS.This issue affects 无觅相关文章插件: from n/a through <= 1.0.5.7.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public-facing WordPress plugin enables remote exploitation of web application (T1190) and injection/execution of arbitrary JavaScript in victim browsers (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the improper neutralization of input that enables stored XSS by requiring validation of user inputs before processing or storage in the WordPress plugin.
Prevents execution of injected scripts during web page generation by filtering information outputs, mitigating the stored XSS impact on other users.
Requires identification, reporting, and correction of the specific flaw in the wumii-related-posts plugin up to version 1.0.5.7, eliminating the vulnerability through patching.