CVE-2025-23572
Published: 16 January 2025
Summary
CVE-2025-23572 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-23572 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the WordPress plugin UpDownUpDown postcomment-voting developed by Dave Konopka. The flaw affects all versions of the plugin from n/a through 1.1 inclusive and enables Stored XSS. Published on 2025-01-16, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
The vulnerability can be exploited by unauthenticated attackers accessible over the network with low attack complexity, though it requires user interaction such as clicking a malicious link. By tricking a victim into submitting a forged request, an attacker can inject malicious payloads that result in Stored XSS, persisting the script on the site and potentially executing in the context of other users viewing affected pages, with cross-origin scope change enabling low-level impacts on confidentiality, integrity, and availability.
Mitigation details are documented in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/updownupdown-postcomment-voting/vulnerability/wordpress-updownupdown-plugin-1-1-csrf-to-stored-xss-vulnerability?_s_id=cve. Security practitioners should consult this reference for patch availability and remediation steps specific to the affected plugin versions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3256
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in Dave Konopka UpDownUpDown updownupdown-postcomment-voting allows Stored XSS.This issue affects UpDownUpDown: from n/a through <= 1.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF to Stored XSS in public-facing WordPress plugin enables T1190 (exploit public-facing app), delivered via malicious link (T1566.002) resulting in JS execution (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 enforces session authenticity mechanisms like CSRF tokens to prevent unauthorized forged requests from injecting Stored XSS payloads via this vulnerability.
SI-10 validates inputs to block malicious XSS scripts from being accepted and stored through the CSRF exploitation in the UpDownUpDown plugin.
SI-2 ensures timely patching and remediation of the specific CSRF-to-Stored XSS flaw affecting UpDownUpDown plugin versions through 1.1.