CVE-2025-23426
Published: 16 January 2025
Summary
CVE-2025-23426 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SC-23 requires mechanisms to protect session authenticity, directly mitigating CSRF attacks that trick authenticated users into storing XSS payloads.
SI-10 enforces input validation to reject or sanitize malicious XSS payloads submitted via CSRF requests before storage.
SI-15 applies output filtering to neutralize stored XSS payloads, preventing their execution regardless of how they were stored via CSRF.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF-to-stored-XSS in public-facing WordPress plugin directly enables T1190 (Exploit Public-Facing Application) and facilitates T1185 (Browser Session Hijacking) via injected scripts.
NVD Description
Cross-Site Request Forgery (CSRF) vulnerability in Binesh Dobhal go Social go-social allows Stored XSS.This issue affects go Social: from n/a through <= 1.0.
Deeper analysisAI
CVE-2025-23426 is a Cross-Site Request Forgery (CSRF) vulnerability in the go-social WordPress plugin by Binesh Dobhal that enables Stored Cross-Site Scripting (XSS). The issue affects the plugin from unknown initial versions through 1.0 inclusive, as documented under CWE-352.
Attackers with network access can exploit this vulnerability without authentication privileges, though it requires user interaction and has low attack complexity. Exploitation changes the scope (S:C) and results in low impacts to confidentiality, integrity, and availability, yielding a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). A malicious actor can craft a CSRF attack to trick an authenticated user into submitting a request that stores an XSS payload on the site.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/go-social/vulnerability/wordpress-go-social-plugin-1-0-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve provides details on this CSRF-to-Stored XSS vulnerability in go-social version 1.0.
Details
- CWE(s)