CVE-2025-25142
Published: 03 March 2025
Description
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Security Summary
CVE-2025-25142 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Stored Cross-site Scripting (XSS) as classified under CWE-79, in the WP Less Compiler plugin (wp-less-compiler) developed by The Jake Group for WordPress. This issue affects all versions of the plugin from its initial release through 1.3.0 inclusive. The vulnerability was published on 2025-03-03 with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Unauthenticated attackers with network access can exploit this vulnerability by submitting malicious input that gets stored and reflected in generated web pages, though it requires user interaction such as a victim viewing the affected page. Exploitation changes scope and allows limited impacts on confidentiality, integrity, and availability, potentially enabling script execution in the victim's browser context to steal session data or perform other actions within the site's permissions.
The Patchstack advisory provides details on this vulnerability, including recommendations for mitigation, accessible at https://patchstack.com/database/Wordpress/Plugin/wp-less-compiler/vulnerability/wordpress-wp-less-compiler-plugin-1-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Stored XSS in public-facing WordPress plugin directly enables remote exploitation of the web app (T1190), facilitates drive-by compromise via malicious page content (T1189), and supports browser session hijacking through script execution to steal session data (T1185).