Cyber Posture

CVE-2025-23759

High

Published: 31 January 2025

Published
31 January 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0018 38.9th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.

Security Summary

CVE-2025-23759 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Affiliate Tools Việt Nam WordPress plugin. This issue affects all versions from n/a through 0.3.17 inclusive, as published on 2025-01-31.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Any network-accessible attacker without privileges can exploit it by crafting malicious input that reflects back to users, requiring user interaction such as clicking a specially crafted link. Exploitation changes the security scope, enabling low-impact effects on confidentiality, integrity, and availability, such as executing scripts in the victim's browser context to steal session data or manipulate page content.

Patchstack provides details on this WordPress plugin vulnerability, including assessment and potential mitigation steps, accessible at https://patchstack.com/database/Wordpress/Plugin/affiliate-tools-viet-nam/vulnerability/wordpress-affiliate-tools-viet-nam-plugin-0-3-17-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.

Details

CWE(s)
CWE-79

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1539 Steal Web Session Cookie Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
Why these techniques?

Reflected XSS in public-facing WordPress plugin enables exploitation of the application (T1190) and facilitates stealing web session cookies via injected scripts (T1539).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

References