CVE-2025-23476
Published: 16 January 2025
Summary
CVE-2025-23476 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-23476 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the my-related-posts WordPress plugin developed by isnowfy. This flaw enables Stored Cross-Site Scripting (XSS) and affects all versions of the plugin up to and including 1.1. The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility with low attack complexity.
Remote attackers without privileges can exploit the vulnerability by tricking authenticated users into visiting a malicious webpage that submits a forged request. This CSRF action leads to the storage of malicious scripts, enabling Stored XSS that can affect site visitors, including administrators, with low impacts on confidentiality, integrity, and availability due to the changed scope.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/my-related-posts/vulnerability/wordpress-my-related-posts-plugin-1-1-csrf-to-stored-xss-vulnerability?_s_id=cve provides details on the vulnerability in the my-related-posts WordPress plugin version 1.1.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3202
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in isnowfy my-related-posts my-related-posts allows Stored XSS.This issue affects my-related-posts: from n/a through <= 1.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF to stored XSS in public-facing WordPress plugin directly enables T1190 exploitation and facilitates T1059.007 JavaScript execution in victim browsers.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely flaw remediation, directly addressing the CSRF to Stored XSS vulnerability in the my-related-posts WordPress plugin by patching affected versions up to 1.1.
SC-23 enforces communications session authenticity, preventing forged CSRF requests that trick authenticated users into storing malicious scripts.
SI-10 validates inputs to block malicious scripts submitted via CSRF from being stored in the WordPress plugin.