CVE-2025-23483

High

Published: 16 January 2025

Published

16 January 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS Score 0.0014 33.7th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-23483 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-23483 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Universal Analytics Injector WordPress plugin developed by hoyce. This flaw allows for Stored XSS and affects all versions of the plugin from its initial release through 1.0.3. The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility and scope change.

An unauthenticated attacker can exploit this vulnerability remotely with low attack complexity, requiring only user interaction such as tricking a site administrator into performing a malicious action, like visiting a crafted webpage. Successful exploitation enables the injection of stored XSS payloads via CSRF, potentially allowing attackers to steal sensitive data, impersonate users, or execute arbitrary scripts in the context of the affected site, with low impacts to confidentiality, integrity, and availability but elevated risk due to the changed scope.

The Patchstack advisory provides details on this WordPress plugin vulnerability, including recommendations for mitigation such as updating to a patched version if available or removing the plugin. Security practitioners should consult https://patchstack.com/database/Wordpress/Plugin/universal-analytics-injector/vulnerability/wordpress-universal-analytics-injector-plugin-1-0-3-csrf-to-stored-xss-vulnerability?_s_id=cve for specific remediation steps.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-3204

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in hoyce Universal Analytics Injector universal-analytics-injector allows Stored XSS.This issue affects Universal Analytics Injector: from n/a through <= 1.0.3.

CWE(s): CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.007 JavaScript Execution

Adversaries may abuse various implementations of JavaScript for execution.

attack.mitre.org →

Why these techniques?

The CVE describes a CSRF vulnerability in a public-facing WordPress plugin that enables stored XSS injection, directly mapping to exploitation of public-facing applications (T1190) and client-side arbitrary script execution via JavaScript (T1059.007).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1