CVE-2025-28869
Published: 26 March 2025
Summary
CVE-2025-28869 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 38.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-28869 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the NextGEN Gallery Voting WordPress plugin (nextgen-gallery-voting) by shauno. The issue affects all versions from n/a through 2.7.6, allowing malicious input to be reflected and executed as script on affected web pages.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, and user interaction such as clicking a malicious link. Remote attackers can exploit it by crafting payloads delivered via user-induced inputs, achieving arbitrary JavaScript execution in the victim's browser context due to the changed scope (S:C). This enables low-level impacts on confidentiality, integrity, and availability, such as stealing session cookies, defacing pages, or phishing within the site's domain.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/nextgen-gallery-voting/vulnerability/wordpress-nextgen-gallery-voting-plugin-2-7-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8156
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shauno NextGEN Gallery Voting nextgen-gallery-voting allows Reflected XSS.This issue affects NextGEN Gallery Voting: from n/a through <= 2.7.6.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin enables exploitation of the web app (T1190) via crafted malicious links requiring user click (T1204.001) to achieve arbitrary JavaScript execution in browser (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of the specific reflected XSS flaw in the NextGEN Gallery Voting plugin via patching or updates.
Directly addresses improper neutralization during web page generation by filtering output to prevent execution of reflected malicious JavaScript payloads.
Enforces input validation at the application layer to neutralize XSS payloads in user-induced inputs before reflection on web pages.