CVE-2025-23499
Published: 16 January 2025
Summary
CVE-2025-23499 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-23499 is a Cross-Site Request Forgery (CSRF) vulnerability in the Board Election WordPress plugin by Pascal Casier that allows Stored XSS. This issue affects the plugin from unknown initial versions through version 1.0.1 inclusive. The vulnerability is associated with CWE-352 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to network accessibility, low attack complexity, no required privileges, user interaction, and changed scope with low impacts on confidentiality, integrity, and availability.
Attackers can exploit this vulnerability without authentication privileges over the network by tricking authenticated users into performing unintended actions via a forged request, leading to the storage of malicious XSS payloads. Once stored, the XSS executes in the context of other users viewing affected pages, potentially enabling theft of session data, site defacement, or further compromise within the changed scope of the Cross-Origin Resource Sharing.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/board-election/vulnerability/wordpress-board-election-plugin-1-0-1-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve documents the CSRF-to-Stored XSS vulnerability specifically in Board Election plugin version 1.0.1 and provides details on the issue for mitigation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3212
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in Pascal Casier Board Election board-election allows Stored XSS.This issue affects Board Election: from n/a through <= 1.0.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF to stored XSS in public-facing WordPress plugin directly enables T1190 (network exploit of public app), T1204.001 (user tricked via malicious link to trigger forged request), T1185 (XSS enables session data theft), and T1491.002 (XSS enables site defacement).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 enforces session authenticity mechanisms like anti-CSRF tokens, directly preventing forged requests that trick users into storing malicious XSS payloads.
SI-10 requires validation of all inputs to the Board Election plugin, blocking malicious XSS payloads from being stored via CSRF exploitation.
SI-15 mandates output filtering and encoding, preventing execution of any stored XSS payloads when affected pages are viewed by other users.