CVE-2025-22559
Published: 07 January 2025
Summary
CVE-2025-22559 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-22559 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, affecting the TubePress.NET WordPress plugin (tubepressnet). This issue impacts all versions from n/a through 4.0.1, as published on 2025-01-07. The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), highlighting its potential for network-based exploitation with low complexity and changed scope.
Attackers without privileges can exploit this CSRF flaw remotely by tricking authenticated users into interacting with malicious content, such as a crafted webpage. Successful exploitation requires user interaction but enables the attacker to force the victim's browser to submit unintended requests to the vulnerable plugin, potentially resulting in unauthorized actions with low impacts on confidentiality, integrity, and availability.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/tubepressnet/vulnerability/wordpress-tubepress-net-plugin-4-0-1-csrf-to-stored-xss-vulnerability?_s_id=cve details this as a CSRF-to-stored XSS vulnerability in TubePress.NET version 4.0.1 for WordPress, providing further technical analysis for mitigation strategies.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2837
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in tubepress TubePress.NET tubepressnet allows Cross Site Request Forgery.This issue affects TubePress.NET: from n/a through <= 4.0.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF-to-stored-XSS in public-facing WordPress plugin directly enables remote exploitation of a web application (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CSRF by enforcing mechanisms like unique session tokens to verify the authenticity of state-changing requests.
Requires timely identification, reporting, and patching of flaws like this CSRF-to-stored XSS vulnerability in the TubePress.NET plugin.
Addresses the stored XSS component of the vulnerability by validating and sanitizing untrusted inputs submitted via CSRF attacks.