Cyber Posture

CVE-2025-28921

High

Published: 26 March 2025

Published
26 March 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0021 43.6th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-28921 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious Link (T1204.001); ranked at the 43.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Threat & Defense at a Glance

What attackers do: exploitation maps to Malicious Link (T1204.001) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly addresses the CVE by requiring timely remediation of the specific reflected XSS flaw in the SpatialMatch IDX plugin through patching to versions beyond 3.0.9.

prevent

Prevents reflected XSS by enforcing output filtering and encoding of untrusted inputs during web page generation in the vulnerable plugin.

prevent

Mitigates the improper neutralization vulnerability by validating all user inputs to block malicious XSS payloads before processing in the web application.

MITRE ATT&CK Enterprise TechniquesAI

T1204.001 Malicious Link Execution
An adversary may rely upon a user clicking a malicious link in order to gain execution.
T1566.002 Spearphishing Link Initial Access
Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.
Why these techniques?

The reflected XSS vulnerability is directly exploited via crafted malicious links that require user interaction to reflect and execute arbitrary JavaScript in the victim's browser, mapping to malicious link delivery and spearphishing link techniques.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in homejunction SpatialMatch IDX spatialmatch-free-lifestyle-search allows Reflected XSS.This issue affects SpatialMatch IDX: from n/a through <= 3.0.9.

Deeper analysisAI

CVE-2025-28921 is an improper neutralization of input during web page generation vulnerability, enabling reflected cross-site scripting (XSS) as classified under CWE-79. It affects the SpatialMatch IDX WordPress plugin (spatialmatch-free-lifestyle-search) from homejunction, impacting versions from n/a through 3.0.9 inclusive.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility with low attack complexity, no required privileges, but necessitating user interaction. Remote attackers can exploit it by tricking users into interacting with malicious input, such as via a crafted link or payload reflected in the web page, achieving low impacts on confidentiality, integrity, and availability within a changed scope.

The Patchstack advisory provides further details on the vulnerability in the WordPress SpatialMatch IDX plugin version 3.0.9, including mitigation guidance, accessible at https://patchstack.com/database/Wordpress/Plugin/spatialmatch-free-lifestyle-search/vulnerability/wordpress-spatialmatch-idx-plugin-3-0-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.

Details

CWE(s)

CVEs Like This One

CVE-2025-22631Shared CWE-79
CVE-2025-22575Shared CWE-79
CVE-2025-23674Shared CWE-79
CVE-2025-23812Shared CWE-79
CVE-2025-23629Shared CWE-79
CVE-2025-28903Shared CWE-79
CVE-2025-69323Shared CWE-79
CVE-2025-23633Shared CWE-79
CVE-2025-24563Shared CWE-79
CVE-2025-68846Shared CWE-79

References