CVE-2025-23436
Published: 16 January 2025
Summary
CVE-2025-23436 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-23436 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the WP-Scribd-List WordPress plugin (wp-scribd-list) that enables Stored XSS. This issue affects all versions of the plugin from n/a through 1.2 inclusive. The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility, low complexity, lack of required privileges, and scope change.
Unauthenticated attackers can exploit the CSRF flaw over the network by tricking authenticated users into performing unintended actions via malicious requests, such as from a crafted webpage. This leads to Stored XSS execution in the context of the targeted site, with low impacts on confidentiality, integrity, and availability but elevated risk from the changed scope.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/wp-scribd-list/vulnerability/wordpress-wp-scribd-list-plugin-1-2-csrf-to-xss-vulnerability?_s_id=cve) documents the CSRF-to-XSS vulnerability in WP-Scribd-List version 1.2 and provides associated details for mitigation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3182
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in capa Wp-Scribd-List wp-scribd-list allows Stored XSS.This issue affects Wp-Scribd-List: from n/a through <= 1.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF-to-Stored XSS in public-facing WordPress plugin directly enables exploitation of public-facing applications (T1190) and facilitates arbitrary JavaScript execution via XSS (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CVE by requiring identification, reporting, and patching of the CSRF-to-Stored XSS flaw in the WP-Scribd-List plugin.
Enforces session authenticity mechanisms like anti-CSRF tokens to prevent unauthenticated attackers from tricking users into submitting malicious requests.
Validates information inputs to block malicious payloads that could lead to Stored XSS execution via the CSRF vector.