Cyber Posture

CVE-2025-23584

High

Published: 03 March 2025

Published
03 March 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0023 45.9th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.

Security Summary

CVE-2025-23584 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the WordPress plugin "Pin Locations on Map" by arsh91. The issue affects the plugin from unknown initial versions through version 1.0 inclusive. Published on 2025-03-03, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility and scope change.

Attackers can exploit this reflected XSS vulnerability remotely over the network with low attack complexity and no required privileges, though it necessitates user interaction such as clicking a malicious link. Exploitation reflects unsanitized input into the web page, enabling script execution in the victim's browser context. This can result in limited impacts to confidentiality, integrity, and availability, such as session token theft or minor site defacement, particularly if the victim has elevated privileges on the WordPress site.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/pin-locations-on-map/vulnerability/wordpress-pin-locations-on-map-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve, which covers the reflected XSS in the Pin Locations on Map plugin version 1.0. Security practitioners should consult this reference for patching instructions and workaround guidance.

Details

CWE(s)
CWE-79

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1566.002 Spearphishing Link Initial Access
Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.
Why these techniques?

Reflected XSS in public-facing WordPress plugin is exploited via malicious links (spearphishing) to execute scripts in victim's browser.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References