Cyber Resilience

CVE-2025-23569

High

Published: 16 January 2025

Published
16 January 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0006 17.6th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-23569 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-23569 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Kelvin Ng Shortcode in Comment WordPress plugin (shortcode-in-comment) that allows Stored XSS. The issue affects all versions from n/a through 1.1.1 and was published on 2025-01-16. It has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), rated as High severity.

Unauthenticated attackers can exploit this vulnerability over the network with low attack complexity by tricking authenticated users into performing actions via a forged request, as user interaction is required. Successful exploitation changes scope and enables stored XSS, allowing limited impacts to confidentiality, integrity, and availability through persistent script injection in comments.

The Patchstack advisory provides further details on this vulnerability, including mitigation recommendations, at https://patchstack.com/database/Wordpress/Plugin/shortcode-in-comment/vulnerability/wordpress-shortcode-in-comment-plugin-1-1-1-csrf-to-stored-xss-vulnerability?_s_id=cve.

EU & UK References

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in Kelvin Ng Shortcode in Comment shortcode-in-comment allows Stored XSS.This issue affects Shortcode in Comment: from n/a through <= 1.1.1.

CWE(s)
CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
attack.mitre.org →
Why these techniques?

CSRF vuln in public-facing WordPress plugin directly enables T1190 exploitation; stored XSS facilitates JavaScript execution via T1059.007.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-28931Shared CWE-352
CVE-2025-23980Shared CWE-352
CVE-2025-23710Shared CWE-352
CVE-2025-23822Shared CWE-352
CVE-2025-25128Shared CWE-352
CVE-2025-31616Shared CWE-352
CVE-2025-23483Shared CWE-352
CVE-2025-23817Shared CWE-352
CVE-2025-23446Shared CWE-352
CVE-2025-23664Shared CWE-352

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly remediates the CSRF to stored XSS flaw in the Shortcode in Comment WordPress plugin through identification, reporting, testing, and installation of software updates.

SC-23 Session Authenticity good match
prevent

Ensures the authenticity of communications sessions to prevent unauthenticated attackers from forging requests that trick authenticated users into injecting XSS payloads via comments.

SI-10 Information Input Validation good match
prevent

Validates and sanitizes shortcode inputs in comments to block malicious XSS payloads from being stored and executed.

References