CVE-2026-25351
Published: 25 March 2026
Summary
CVE-2026-25351 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 11.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses reflected XSS by filtering information outputs to neutralize malicious scripts before rendering in the victim's browser.
Prevents exploitation by validating and sanitizing user inputs that are improperly neutralized during web page generation.
Mitigates the vulnerability through timely identification, reporting, and patching of the flaw in MyMedi versions prior to 1.7.7.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS enables script execution in victim's browser via crafted malicious URL requiring user interaction, directly mapping to drive-by compromise (T1189) and user execution via malicious link (T1204.001).
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup MyMedi mymedi allows Reflected XSS.This issue affects MyMedi: from n/a through < 1.7.7.
Deeper analysisAI
CVE-2026-25351 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the skygroup MyMedi WordPress theme. This issue affects MyMedi versions from n/a through those prior to 1.7.7. Published on 2026-03-25T17:16:45.900, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Remote attackers require no privileges to exploit this vulnerability by crafting malicious inputs that are reflected without proper neutralization during web page generation. Exploitation depends on user interaction, such as a victim accessing a malicious URL, enabling the attacker to inject and execute scripts in the victim's browser context. This can result in low impacts to confidentiality, integrity, and availability, with a changed scope due to cross-origin effects.
The Patchstack advisory details this as a Reflected XSS vulnerability in the MyMedi WordPress theme, fixed in version 1.7.7. Mitigation involves updating affected WordPress installations to MyMedi 1.7.7 or later.
Details
- CWE(s)