Cyber Posture

CVE-2025-27275

High

Published: 03 March 2025

Published
03 March 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0021 42.8th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse various implementations of JavaScript for execution.

Security Summary

CVE-2025-27275 is an improper neutralization of input during web page generation vulnerability, enabling reflected cross-site scripting (XSS) as classified under CWE-79, in the WordPress plugin WOO Codice Fiscale by andrew_fisher. The issue affects all versions of the plugin from n/a through 1.6.3 inclusive. Published on 2025-03-03, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to network accessibility and scope change.

Attackers can exploit this vulnerability remotely over the network with low attack complexity, requiring no privileges but user interaction, such as clicking a malicious link that reflects unsanitized input back into the web page. Exploitation occurs in the victim's browser context, allowing limited impacts on confidentiality, integrity, and availability, such as potential theft of session cookies, defacement of pages for the user, or minor disruptions.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/woo-codice-fiscale/vulnerability/wordpress-woo-codice-fiscale-plugin-1-6-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve details the vulnerability in the WordPress WOO Codice Fiscale plugin version 1.6.3 and provides associated guidance for practitioners.

Details

CWE(s)
CWE-79

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
Why these techniques?

Reflected XSS in public-facing WordPress plugin directly enables exploitation of public-facing applications (T1190) and JavaScript execution in victim browser (T1059.007).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References