CVE-2025-48094
Published: 22 January 2026
Summary
CVE-2025-48094 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 20.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-48094 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the LambertGroup Magic Slider (magic_slider) WordPress plugin. The issue affects all versions from n/a through 2.2 inclusive and was published on 2026-01-22.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility with low attack complexity, no required privileges, and user interaction such as clicking a malicious link. Unauthenticated attackers can exploit it by injecting malicious scripts into reflected user input on affected sites, achieving limited impacts on confidentiality, integrity, and availability within a changed security scope, such as session hijacking or script execution in the victim's browser.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/magic_slider/vulnerability/wordpress-magic-slider-plugin-2-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve) documents the Reflected XSS in Magic Slider version 2.2, providing details for security practitioners to assess and apply mitigations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4107
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Magic Slider magic_slider allows Reflected XSS.This issue affects Magic Slider: from n/a through <= 2.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS directly enables browser session hijacking via malicious script injection and execution in victim browsers.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation and neutralization of untrusted reflected input before it is used in web page generation, directly blocking the CWE-79 XSS payload in Magic Slider.
Mandates filtering or encoding of information output during page generation, preventing malicious scripts from being reflected back to the victim's browser.
Provides mechanisms to detect and block malicious script code injected via the reflected XSS vector before execution in the browser context.