Cyber Posture

CVE-2025-22501

High

Published: 28 March 2025

Published
28 March 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0044 63.1th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.

Security Summary

CVE-2025-22501 is an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability, classified as CWE-80, in the Improve My City WordPress plugin (improve-my-city). This reflected XSS issue affects all versions of the plugin from n/a through 1.6.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). An unauthenticated attacker accessible over the network can exploit it with low complexity by tricking a user into performing an action, such as visiting a malicious link, which reflects attacker-controlled input containing script elements. Exploitation changes the scope and results in low impacts to confidentiality, integrity, and availability in the victim's browser context.

Patchstack provides details on this vulnerability in their advisory at https://patchstack.com/database/Wordpress/Plugin/improve-my-city/vulnerability/wordpress-improve-my-city-plugin-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve, which security practitioners should consult for mitigation guidance and patch information.

Details

CWE(s)
CWE-80

MITRE ATT&CK Enterprise Techniques

T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
T1566.002 Spearphishing Link Initial Access
Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.
Why these techniques?

Reflected XSS enables arbitrary JavaScript execution in the victim's browser via a crafted malicious link.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References