CVE-2025-23754
Published: 27 January 2025
Description
Adversaries may abuse various implementations of JavaScript for execution.
Security Summary
CVE-2025-23754 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the WordPress plugin "The Loops" (the-loops) developed by Ulrich Sossou. This issue affects The Loops from n/a through version 1.0.2 inclusive. The vulnerability was published on 2025-01-27.
The CVSS v3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no privileges required, and user interaction needed, with changed scope and low impacts on confidentiality, integrity, and availability. Remote attackers can exploit it by tricking authenticated or unauthenticated users into interacting with maliciously crafted links or inputs reflected in web pages, potentially executing arbitrary scripts in the victim's browser context.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/the-loops/vulnerability/wordpress-the-loops-plugin-1-0-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Reflected XSS in public-facing WordPress plugin enables exploitation of web applications (T1190) and arbitrary JavaScript execution in browser (T1059.007) via malicious links.