CVE-2026-25033
Published: 25 March 2026
Summary
CVE-2026-25033 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2026-25033 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-Site Scripting (XSS) under CWE-79, affecting the Motta Addons WordPress plugin developed by uixthemes. The flaw exists in versions from n/a through those prior to 1.6.1, where user input is not properly sanitized during web page generation, enabling malicious script injection. Published on 2026-03-25, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to network accessibility, low attack complexity, and scope change.
A remote attacker without privileges can exploit this vulnerability by crafting a malicious URL containing a script payload that is reflected back unsanitized in the generated web page. Exploitation requires user interaction, such as a site visitor clicking a phishing link or visiting a booby-trapped page, at which point the injected script executes in the victim's browser context. This allows limited impacts including low-level compromise of confidentiality (e.g., session token theft), integrity (e.g., page manipulation), and availability, with the changed scope potentially affecting other users or resources on the site.
The Patchstack advisory confirms the issue was addressed in Motta Addons version 1.6.1, recommending immediate updates to patched versions for mitigation. Security practitioners should verify plugin installations, enforce input validation best practices, and monitor for anomalous traffic patterns indicative of XSS attempts.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-15633
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uixthemes Motta Addons motta-addons allows Reflected XSS.This issue affects Motta Addons: from n/a through < 1.6.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables T1190 (exploit public-facing app), T1539 (steal web session cookies via script), T1185 (browser session hijacking), and is delivered via T1566.002/T1204.001 malicious phishing links requiring user click.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-15 requires filtering of information outputs to prevent malicious scripts like those in reflected XSS from executing in users' browsers.
SI-10 enforces validation of user-supplied inputs, directly addressing the improper neutralization of input that enables script injection in this CVE.
SI-2 mandates timely flaw remediation, such as patching the Motta Addons plugin to version 1.6.1 to eliminate the specific XSS vulnerability.