Cyber Posture

CVE-2025-24635

High

Published: 31 January 2025

Published
31 January 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0018 38.9th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.

Security Summary

CVE-2025-24635 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, affecting the Paytm Payment Donation WordPress plugin (paytm-donation) in all versions up to and including 2.3.1. Published on 2025-01-31, the issue resides in the integrationdevpaytm component and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

Attackers can exploit this vulnerability remotely over the network with low complexity and no required privileges, though it demands user interaction such as clicking a malicious link. Successful exploitation enables reflected XSS, allowing attackers to inject and execute arbitrary scripts in the victim's browser context, potentially compromising low-level confidentiality, integrity, and availability with a changed scope.

The Patchstack advisory details this Reflected XSS vulnerability in the WordPress Paytm Donation plugin up to version 2.3.1, serving as the primary reference for security practitioners monitoring the issue.

Details

CWE(s)
CWE-79

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1204.001 Malicious Link Execution
An adversary may rely upon a user clicking a malicious link in order to gain execution.
T1566.002 Spearphishing Link Initial Access
Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.
Why these techniques?

Reflected XSS in public-facing WordPress plugin exploited remotely via crafted malicious link requiring user interaction (UI:R), directly enabling T1190 for public-facing app exploitation and T1566.002/T1204.001 for phishing/user execution delivery vectors.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References