Security readout for executives and security teams
Plain-English summary
CVE-2025-23738 affects Padam Shankhadev's Ps Ads Pro WordPress plugin through version 1.0.0. It is reflected XSS: an attacker may trick a user into opening a malicious link, causing script to run in that user's browser. Impact can include limited data exposure, content changes, or disruption depending on the victim's privileges.
Executive priority
Treat this as high priority for WordPress estates using Ps Ads Pro, especially sites with privileged administrators. It is not currently sourced as actively exploited, but the score and no-auth network vector justify prompt inventory and remediation tracking.
Technical view
The CVE describes CWE-79 improper neutralization during web page generation in ps-ads-pro. CVSS 3.1 is 7.1 high with AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating network reachability, low complexity, no prior privileges, required user interaction, changed scope, and low CIA impacts.
Likely exposure
Exposure is limited to WordPress sites running the Ps Ads Pro plugin at version 1.0.0 or earlier. The bundle does not show affected CPEs, install prevalence, or hosted-service exposure.
Exploitation context
The source bundle does not show KEV listing or active exploitation evidence. Exploitation requires user interaction, consistent with reflected XSS, so risk depends on who can be targeted and their WordPress privileges.
Researcher notes
Evidence is sparse. The description says Ps Ads Pro through <= 1.0.0 is affected, while the affected record lists version "0" and defaultStatus "unaffected" without CPEs. Use the CVE and Patchstack entry as primary leads, then confirm vendor remediation details.
Mitigation direction
- Inventory WordPress sites for the ps-ads-pro plugin and record installed versions.
- Check vendor, WordPress plugin, or Patchstack guidance for a fixed version or official mitigation.
- Prioritize update, removal, or temporary disablement where the plugin is present and business risk allows.
- Limit administrator exposure to untrusted links until remediation status is confirmed.
Validation and detection
- Confirm whether Ps Ads Pro is installed on each WordPress instance.
- Verify the installed plugin version is greater than 1.0.0 before treating it as remediated.
- Review security monitoring for suspicious reflected-XSS indicators against plugin pages or parameters.
- Document cases where no vendor fix is available and track vendor guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-23738 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L2.83.7PatchstackVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://patchstack.com/database/Wordpress/Plugin/ps-ads-pro/vulnerability/wordpress-ps-ads-pro-plugin-1-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cveCVE reference, Patchstack · vdb-entry
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.