CVE-2025-27271
Published: 03 March 2025
Description
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Security Summary
CVE-2025-27271 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the DB Tables Import/Export WordPress plugin by Alberto Cocchiara. The issue affects the plugin from its initial release through version 1.0.1.
An unauthenticated attacker (PR:N) can exploit this over the network (AV:N) with low attack complexity (AC:L), but it requires user interaction (UI:R), such as clicking a malicious link. Exploitation changes the security scope (S:C) and enables low-impact effects on confidentiality, integrity, and availability (C:L/I:L/A:L), yielding a CVSS v3.1 base score of 7.1. This allows script execution in the victim's browser context, potentially leading to session hijacking or data theft from authenticated users.
The primary advisory from Patchstack, available at https://patchstack.com/database/Wordpress/Plugin/db-tables-importexport/vulnerability/wordpress-db-tables-import-export-plugin-1-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve, documents this WordPress plugin vulnerability and provides details for practitioners to assess and address it.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables exploitation of public-facing apps (T1190), arbitrary JavaScript execution in browser (T1059.007), and session hijacking via script context (T1185).