CVE-2025-28903
Published: 26 March 2025
Description
An adversary may rely upon a user clicking a malicious link in order to gain execution.
Security Summary
CVE-2025-28903 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the hectorgarrofe Driving Directions (ddirections) WordPress plugin. This issue affects all versions of the plugin from n/a through 1.4.4, as published on 2025-03-26.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility with low attack complexity, no required privileges, and user interaction needed. Remote attackers can exploit it by crafting malicious inputs that reflect XSS payloads in web page generation, tricking authenticated users (such as site visitors or admins) into interacting via a malicious link or input. Exploitation enables limited impacts on confidentiality, integrity, and availability, with a changed scope (S:C) allowing cross-origin execution, potentially leading to session token theft or malicious script injection in the victim's browser.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/ddirections/vulnerability/wordpress-driving-directions-plugin-1-4-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve, which covers the Reflected XSS in the WordPress Driving Directions plugin version 1.4.4.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Reflected XSS enables crafting malicious links (T1566.002) that trick users into clicking to execute injected scripts in browser (T1204.001), leading to session theft or further actions.