CVE-2025-23845
Published: 17 February 2025
Description
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
Security Summary
CVE-2025-23845 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Reflected Cross-site Scripting (XSS) as classified under CWE-79. It affects the ERA404 ImageMeta WordPress plugin (imagemeta), impacting all versions from an unspecified initial release through 1.1.2. The issue was published on 2025-02-17.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no privileges required, and user interaction needed for exploitation. Attackers can deliver malicious payloads via reflected input on web pages generated by the plugin, potentially tricking authenticated users into executing scripts in their browsers. With changed scope, exploitation may impact other users or application components, achieving low confidentiality, integrity, and availability effects such as session hijacking or data exfiltration.
The Patchstack advisory details this Reflected XSS in the WordPress ImageMeta plugin up to version 1.1.2 and recommends mitigation through updating to a patched release. Further details are available at https://patchstack.com/database/Wordpress/Plugin/imagemeta/vulnerability/wordpress-imagemeta-plugin-1-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Reflected XSS directly enables browser script execution for session hijacking (T1185) and stealing web session cookies (T1539), as described in the CVE impacts.