Cyber Resilience

CVE-2025-23430

High

Published: 16 January 2025

Published
16 January 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0014 33.7th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-23430 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2025-23430 is a Cross-Site Request Forgery (CSRF) vulnerability in the Mass Custom Fields Manager WordPress plugin developed by Oren Yomtov, which enables Reflected Cross-Site Scripting (XSS). The flaw affects the plugin in all versions from n/a through 1.5 inclusive.

Attackers can exploit this vulnerability remotely over the network without authentication privileges, though it requires user interaction. Per the CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), exploitation changes scope and results in low impacts to confidentiality, integrity, and availability, typically allowing arbitrary script execution in the victim's browser context via CSRF-induced actions.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/mass-custom-fields-manager/vulnerability/wordpress-mass-custom-fields-manager-plugin-1-5-csrf-to-cross-site-scripting-xss-vulnerability?_s_id=cve.

EU & UK References

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in Oren Yomtov Mass Custom Fields Manager mass-custom-fields-manager allows Reflected XSS.This issue affects Mass Custom Fields Manager: from n/a through <= 1.5.

CWE(s)
CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
attack.mitre.org →
Why these techniques?

CSRF to reflected XSS in public-facing WordPress plugin enables T1190 (exploit public-facing application) and facilitates T1059.007 (JavaScript execution via arbitrary script in browser context).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-28931Shared CWE-352
CVE-2025-23980Shared CWE-352
CVE-2025-23710Shared CWE-352
CVE-2025-23822Shared CWE-352
CVE-2025-25128Shared CWE-352
CVE-2025-31616Shared CWE-352
CVE-2025-23483Shared CWE-352
CVE-2025-23817Shared CWE-352
CVE-2025-23446Shared CWE-352
CVE-2025-23664Shared CWE-352

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly remediates the specific CSRF-to-Reflected XSS flaw in Mass Custom Fields Manager plugin versions <=1.5 by identifying, prioritizing, and applying patches or removal.

SC-23 Session Authenticity good match
prevent

Enforces session authenticity mechanisms such as anti-CSRF tokens to block forged requests that trigger the reflected XSS in the vulnerable plugin endpoint.

SI-15 Information Output Filtering good match
prevent

Filters information outputs from the vulnerable endpoint to prevent execution of reflected XSS payloads injected via CSRF in the victim's browser.

References