CVE-2025-31625
Published: 31 March 2025
Description
Adversaries may abuse various implementations of JavaScript for execution.
Security Summary
CVE-2025-31625 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Stored Cross-Site Scripting (XSS) as defined under CWE-79. It affects the Useinfluence WordPress plugin by ramanparashar, with all versions from n/a through 1.0.8 vulnerable. The issue was published on 2025-03-31.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, and user interaction needed, with changed scope and low impacts to confidentiality, integrity, and availability. Remote attackers without authentication can exploit it by injecting malicious scripts that persist and execute in users' browsers when viewing affected pages.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/useinfluence/vulnerability/wordpress-useinfluence-plugin-1-0-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Stored XSS in public-facing WordPress plugin allows injection of persistent malicious JavaScript that executes in visitors' browsers, directly enabling drive-by compromise (T1189) and JavaScript interpreter abuse (T1059.007).