CVE-2025-23566
Published: 16 January 2025
Summary
CVE-2025-23566 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-23566 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Custom Post Type GUI (custom-post-type-gui) developed by syedamirhussain91. This flaw enables Stored Cross-Site Scripting (XSS) and affects all versions of the plugin up to and including 1.0. The issue is classified under CWE-352 with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, user interaction needed, changed scope, and low impacts across confidentiality, integrity, and availability.
Unauthenticated attackers can exploit this vulnerability remotely by tricking authenticated users—typically site administrators—into visiting a malicious webpage or clicking a crafted link. This user interaction triggers a forged request to the vulnerable plugin endpoint, allowing the attacker to inject and store malicious XSS payloads without direct authentication. Successful exploitation results in persistent XSS, where the payload executes in the browsers of subsequent users viewing affected content, potentially enabling session hijacking, data theft, or further site compromise.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/custom-post-type-gui/vulnerability/wordpress-custom-post-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve, which documents the vulnerability in the Custom Post plugin version 1.0. Security practitioners should update to a patched version if available or disable the plugin pending remediation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3251
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in syedamirhussain91 Custom Post custom-post-type-gui allows Stored XSS.This issue affects Custom Post: from n/a through <= 1.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CSRF-to-stored-XSS flaw in a public-facing WordPress plugin directly enables T1190 (exploiting the vulnerable web application endpoint) and facilitates T1185 (persistent XSS payloads enable browser session hijacking, cookie theft, and data exfiltration in victim browsers).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 mandates mechanisms like anti-CSRF tokens to ensure session authenticity, directly preventing forged requests that exploit this CSRF vulnerability to inject stored XSS payloads.
SI-10 requires validation of all information inputs to reject malicious XSS payloads that could be stored via the CSRF attack in the vulnerable plugin.
SI-2 ensures identification, reporting, and timely remediation of flaws like this CVE through patching or disabling the vulnerable WordPress plugin.