CVE-2025-69051
Published: 22 January 2026
Summary
CVE-2025-69051 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 5.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-69051 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-Site Scripting (XSS) under CWE-79, in the CridioStudio ListingPro Reviews WordPress plugin (listingpro-reviews). It affects all versions of the plugin from n/a through those prior to 2.9.11. The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges, and scope change.
Attackers can exploit this Reflected XSS vulnerability remotely over the network without authentication by tricking authenticated users into interacting with maliciously crafted links or inputs that reflect executable scripts back in the web page. Successful exploitation requires user interaction, such as clicking a link, but allows attackers to achieve low-level impacts on confidentiality, integrity, and availability in a changed security scope, potentially enabling theft of session cookies, impersonation of users, or execution of scripts in the victim's browser context.
Patchstack advisories document this vulnerability in the ListingPro Reviews WordPress plugin, with mitigation achieved by updating to version 2.9.11 or later, as the issue affects versions through < 2.9.11. Security practitioners should verify plugin versions on affected WordPress sites and apply the update promptly to neutralize the risk.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3939
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioStudio ListingPro Reviews listingpro-reviews allows Reflected XSS.This issue affects ListingPro Reviews: from n/a through < 2.9.11.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin enables remote exploitation of web apps (T1190) and direct JavaScript execution in browser context (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and neutralization of untrusted input before it is reflected into web page responses, preventing the exact CWE-79 flaw described.
Requires filtering of information outputs to block executable scripts from being returned in reflected responses to crafted requests.
Mandates timely remediation of known vulnerabilities in the ListingPro Reviews plugin by applying the 2.9.11+ patch that corrects the missing input neutralization.