CVE-2025-23501
Published: 16 January 2025
Summary
CVE-2025-23501 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-23501 is a Cross-Site Request Forgery (CSRF) vulnerability in the SpruceJoy Cookie Consent & Autoblock for GDPR/CCPA WordPress plugin (cookie-consent-autoblock). The flaw allows for Stored Cross-Site Scripting (XSS) and affects all versions up to and including 1.0.1. It carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and maps to CWE-352.
Unauthenticated attackers can exploit this over the network with low attack complexity, though it requires user interaction. By tricking a site administrator or other privileged user into visiting a malicious webpage, an attacker can forge a request to perform an administrative action that injects and stores a malicious XSS payload. The stored script then executes in the context of the site's scope for subsequent visitors, enabling limited impacts such as low confidentiality, integrity, and availability violations, including potential session hijacking or data theft.
Advisories, including the Patchstack database entry at https://patchstack.com/database/Wordpress/Plugin/cookie-consent-autoblock/vulnerability/wordpress-cookie-consent-autoblock-for-gdpr-ccpa-plugin-1-0-1-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve, provide further details on the vulnerability. Security practitioners should review these for recommended mitigations, such as updating the plugin or implementing CSRF protections.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3214
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in SpruceJoy Cookie Consent & Autoblock for GDPR/CCPA cookie-consent-autoblock allows Stored XSS.This issue affects Cookie Consent & Autoblock for GDPR/CCPA: from n/a through <= 1.0.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CSRF vulnerability in the public-facing WordPress plugin directly enables exploitation via T1190 (Exploit Public-Facing Application). The stored XSS payload facilitates T1185 (Browser Session Hijacking) through execution in visitors' browsers, enabling session theft and data exfiltration as described.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 requires session authenticity protections like CSRF tokens, directly preventing forged requests that inject stored XSS payloads in this WordPress plugin vulnerability.
SI-10 enforces input validation to reject malicious XSS payloads submitted via forged CSRF requests, blocking the core injection mechanism.
SI-15 applies output filtering to sanitize and prevent execution of any stored XSS payloads from this CSRF-vectored injection when rendered to users.