Cyber Posture

CVE-2025-23734

High

Published: 24 January 2025

Published
24 January 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0021 42.8th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse various implementations of JavaScript for execution.

Security Summary

CVE-2025-23734 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Gigaom Sphinx go-sphinx WordPress plugin by Casey Bisson. The issue affects versions from n/a through 0.1 inclusive, allowing malicious input to be reflected in web page generation without proper neutralization.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, and user interaction such as clicking a crafted link. Remote attackers can exploit it to execute scripts in victims' browsers, achieving low impacts on confidentiality, integrity, and availability with a changed scope.

Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/go-sphinx/vulnerability/wordpress-gigaom-sphinx-plugin-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve provides details on the vulnerability in the WordPress Gigaom Sphinx plugin version 0.1.

Details

CWE(s)
CWE-79

MITRE ATT&CK Enterprise Techniques

T1204.001 Malicious Link Execution
An adversary may rely upon a user clicking a malicious link in order to gain execution.
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
Why these techniques?

Reflected XSS allows execution of arbitrary JavaScript in the victim's browser via a crafted link requiring user interaction, directly enabling T1204.001 (Malicious Link) and T1059.007 (JavaScript).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References