CVE-2025-23435
Published: 16 January 2025
Summary
CVE-2025-23435 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-23435 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the marcucci Password Protect Plugin for WordPress (password-protect-plugin-for-wordpress) that enables Stored XSS. The vulnerability affects all versions of the plugin from n/a through 0.8.1.0, as published on 2025-01-16.
Attackers with network access can exploit this vulnerability without privileges (PR:N) and with low attack complexity (AC:L), though it requires user interaction (UI:R). Exploitation changes the scope (S:C) and allows limited impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), yielding a CVSS v3.1 base score of 7.1. This enables unauthenticated attackers to trick authenticated users into performing unintended actions via CSRF, resulting in persistent XSS payloads stored on the site.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/password-protect-plugin-for-wordpress/vulnerability/wordpress-password-protect-plugin-for-wordpress-plugin-0-8-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve provides further details on the vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3181
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in marcucci Password Protect Plugin for WordPress password-protect-plugin-for-wordpress allows Stored XSS.This issue affects Password Protect Plugin for WordPress: from n/a through <= 0.8.1.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CSRF to stored XSS vulnerability in a public-facing WordPress plugin directly enables exploitation of public-facing applications (T1190) and allows execution of arbitrary JavaScript through persistent XSS payloads (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 enforces session authenticity through mechanisms like CSRF tokens, directly preventing unauthenticated attackers from tricking users into submitting malicious requests that store XSS payloads.
SI-10 requires validation of inputs to reject malicious XSS payloads injected via CSRF, stopping their storage in the WordPress plugin.
SI-15 filters outputs to encode or sanitize stored XSS payloads, preventing their execution when rendered on the site.