CVE-2025-23762
Published: 03 March 2025
Description
Adversaries may abuse various implementations of JavaScript for execution.
Security Summary
CVE-2025-23762 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as CWE-79, enabling Reflected Cross-site Scripting (XSS) in the DsgnWrks Twitter Importer WordPress plugin by Justin Sternberg. This issue affects the plugin from its initial release through version 1.1.4.
The vulnerability can be exploited by remote attackers over the network (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) but user interaction (UI:R), such as an administrator clicking a malicious link. Exploitation changes scope (S:C) and results in low impacts to confidentiality, integrity, and availability (C:L/I:L/A:L), yielding a CVSS 3.1 base score of 7.1. Attackers can inject and execute arbitrary scripts in the victim's browser context.
Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/dsgnwrks-twitter-importer/vulnerability/wordpress-dsgnwrks-twitter-importer-plugin-1-1-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve documents the Reflected XSS vulnerability in DsgnWrks Twitter Importer plugin version 1.1.4.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables exploitation of the web application (T1190) via malicious links that execute arbitrary JavaScript in the victim's browser context (T1059.007).