CVE-2026-25353
Published: 25 March 2026
Summary
CVE-2026-25353 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 11.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents reflected XSS by validating and sanitizing untrusted web inputs to block malicious script injection.
Filters dynamic web page outputs to neutralize reflected malicious scripts before rendering in the victim's browser.
Mandates timely flaw remediation, including patching Nooni to version 1.5.1 to eliminate the specific XSS vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress theme directly enables T1190 exploitation of the web app; arbitrary script execution in browser context maps to T1059.007 JavaScript and facilitates T1185/T1539 session hijacking or cookie theft.
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Nooni nooni allows Reflected XSS.This issue affects Nooni: from n/a through < 1.5.1.
Deeper analysisAI
CVE-2026-25353 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-Site Scripting (XSS) under CWE-79, affecting the Nooni WordPress theme developed by skygroup. The issue impacts all versions of Nooni from its initial release through those prior to 1.5.1. Published on 2026-03-25, it carries a CVSS v3.1 base score of 7.1 (High), reflecting network accessibility, low attack complexity, no required privileges, user interaction, changed scope, and low impacts to confidentiality, integrity, and availability.
Remote attackers without privileges can exploit this vulnerability by crafting malicious input that is reflected back in dynamically generated web pages, tricking users into interacting with it, such as by clicking a specially crafted link. Successful exploitation executes arbitrary scripts in the victim's browser context, potentially leading to session hijacking, data theft, or further site compromise, though impacts remain limited per the CVSS metrics.
Patchstack advisories indicate the vulnerability was addressed in Nooni version 1.5.1, recommending immediate updates to patched versions for affected WordPress sites using the theme.
Details
- CWE(s)