CVE-2025-23557
Published: 16 January 2025
Summary
CVE-2025-23557 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-23557 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the WordPress plugin "Find Your Reps" (find-your-reps) developed by Kathleen Malone. This flaw allows for Stored Cross-Site Scripting (XSS) and affects all versions of the plugin up to and including 1.2.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, and the need for user interaction, with a changed scope and low impacts on confidentiality, integrity, and availability. Any unauthenticated attacker can exploit it by tricking an authenticated user, such as an administrator, into performing a malicious request via a crafted webpage, resulting in the storage of XSS payloads that execute in the context of the plugin.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/find-your-reps/vulnerability/wordpress-find-your-reps-plugin-1-2-csrf-to-stored-xss-vulnerability?_s_id=cve) documents this CSRF-to-Stored XSS issue in Find Your Reps version 1.2, recommending mitigation through updating the plugin to a version beyond 1.2 where the vulnerability is addressed.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3245
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in Kathleen Malone Find Your Reps find-your-reps allows Stored XSS.This issue affects Find Your Reps: from n/a through <= 1.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a CSRF leading to stored XSS in a public-facing WordPress plugin, directly enabling exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of the specific CSRF-to-Stored XSS flaw in the Find Your Reps WordPress plugin up to version 1.2.
Mandates session authenticity mechanisms such as anti-CSRF tokens to block unauthenticated attackers from forging requests that store XSS payloads.
Enforces validation of user inputs to the plugin, preventing malicious XSS payloads from being accepted and stored via CSRF exploitation.