CVE-2025-23442

High

Published: 16 January 2025

Published

16 January 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS Score 0.0014 33.7th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-23442 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-23442 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the WordPress plugin Shockingly Big IE6 Warning (shockingly-big-ie6-warning) developed by mschertel. The flaw enables Stored XSS and affects all versions of the plugin from its initial release through 1.6.3. It carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, user interaction, and changed scope with low impacts on confidentiality, integrity, and availability.

Attackers without privileges can exploit this vulnerability by tricking authenticated users, typically administrators, into visiting a malicious webpage that forges a request to the vulnerable plugin endpoint. This CSRF action injects and stores an XSS payload, which then executes in the context of other site visitors, potentially leading to session hijacking, data theft, or further site compromise depending on the payload.

The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/shockingly-big-ie6-warning/vulnerability/wordpress-shockingly-big-ie6-warning-plugin-1-6-3-csrf-to-stored-xss-vulnerability?_s_id=cve) documents the issue and provides details on the CSRF-to-Stored XSS chain in version 1.6.3. Security practitioners should consult this reference for specific patch information or mitigation guidance, such as updating to a fixed version if available or implementing CSRF tokens.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-3184

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in mschertel Shockingly Big IE6 Warning shockingly-big-ie6-warning allows Stored XSS.This issue affects Shockingly Big IE6 Warning: from n/a through <= 1.6.3.

CWE(s): CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.007 JavaScript Execution

Adversaries may abuse various implementations of JavaScript for execution.

attack.mitre.org →

Why these techniques?

CSRF to stored XSS in public-facing WordPress plugin directly enables exploitation of the application (T1190) and JavaScript execution via XSS payload (T1059.007).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1