CVE-2025-24641
Published: 14 February 2025
Description
Adversaries may abuse various implementations of JavaScript for execution.
Security Summary
CVE-2025-24641 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Stored Cross-site Scripting (XSS) under CWE-79, in the Better WishList API (better-wlm-api) WordPress plugin developed by rickonline_nl. This issue affects all versions of the plugin from n/a through 1.1.3 inclusive. The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility with low complexity but requiring user interaction.
An unauthenticated remote attacker can exploit this Stored XSS flaw by injecting malicious payloads into plugin inputs that are insufficiently sanitized and stored persistently. When authenticated users or administrators view affected pages, the payload executes in their browser context due to the changed scope (S:C), potentially enabling actions such as session hijacking, data theft, or further site compromise, with low impacts on confidentiality, integrity, and availability.
The Patchstack advisory documents this Stored XSS vulnerability specifically in the WordPress Better Wishlist API plugin up to version 1.1.3, providing details on the issue at https://patchstack.com/database/Wordpress/Plugin/better-wlm-api/vulnerability/wordpress-better-wishlist-api-plugin-1-1-3-stored-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Stored XSS in public-facing WordPress plugin enables remote exploitation of the web application (T1190) and client-side JavaScript execution in browsers (T1059.007) for impacts like session hijacking.