Cyber Resilience

CVE-2025-23617

High

Published: 16 January 2025

Published
16 January 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0006 17.6th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-23617 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-23617 is a Cross-Site Request Forgery (CSRF) vulnerability in the Floatbox Plus WordPress plugin by cybio (floatbox-plus) that allows Stored XSS. The issue affects Floatbox Plus versions from n/a through 1.4.4.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, user interaction, changed scope, and low impacts to confidentiality, integrity, and availability. Unauthenticated attackers can exploit it by tricking authenticated users (such as administrators) into performing unintended actions via forged requests, leading to the storage and execution of malicious XSS payloads visible to other users.

The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/floatbox-plus/vulnerability/wordpress-floatbox-plus-plugin-1-4-4-csrf-to-stored-xss-vulnerability?_s_id=cve) documents the CSRF-to-Stored XSS vulnerability specifically in Floatbox Plus version 1.4.4.

EU & UK References

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in cybio Floatbox Plus floatbox-plus allows Stored XSS.This issue affects Floatbox Plus: from n/a through <= 1.4.4.

CWE(s)
CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
attack.mitre.org →
Why these techniques?

Vulnerability in public-facing WordPress plugin directly enables T1190 exploitation; stored XSS payload enables JavaScript execution via T1059.007.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-28931Shared CWE-352
CVE-2025-23980Shared CWE-352
CVE-2025-23710Shared CWE-352
CVE-2025-23822Shared CWE-352
CVE-2025-25128Shared CWE-352
CVE-2025-31616Shared CWE-352
CVE-2025-23483Shared CWE-352
CVE-2025-23817Shared CWE-352
CVE-2025-23446Shared CWE-352
CVE-2025-23664Shared CWE-352

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SC-23 Session Authenticity good match
prevent

Enforces session authenticity mechanisms like anti-CSRF tokens to prevent unauthenticated attackers from tricking authenticated users into storing malicious XSS payloads via forged requests.

SI-10 Information Input Validation good match
prevent

Validates and sanitizes inputs to the Floatbox Plus plugin to block malicious XSS scripts from being stored as a result of CSRF exploitation.

SI-15 Information Output Filtering good match
prevent

Filters information outputs from the plugin to neutralize any stored XSS payloads before they are rendered and executed in users' browsers.

References