Cyber Posture

CVE-2025-23741

High

Published: 03 March 2025

Published
03 March 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0035 57.2th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities in client applications to execute code.

Security Summary

CVE-2025-23741 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Notifications Center WordPress plugin by Florian Chaillou. The issue affects all versions of the notifications-center plugin from its initial release (n/a) through 1.5.2 inclusive. Published on 2025-03-03, it carries a CVSS v3.1 base score of 7.1.

Unauthenticated remote attackers can exploit this vulnerability over the network with low complexity and no required privileges, but it necessitates user interaction such as clicking a malicious link. Successful exploitation reflects attacker-controlled input as executable script in the victim's browser context, with a changed scope enabling potential impacts beyond the targeted user. This results in low confidentiality, integrity, and availability effects as scored.

The Patchstack advisory provides details on this WordPress plugin vulnerability, including assessment and recommended actions for mitigation, accessible at https://patchstack.com/database/Wordpress/Plugin/notifications-center/vulnerability/wordpress-notifications-center-plugin-1-5-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.

Details

CWE(s)
CWE-79

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

Reflected XSS in public-facing WordPress plugin enables exploitation of Internet-facing web apps (T1190) to execute attacker-controlled scripts in victim browser (T1203).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References