CVE-2025-23627
Published: 16 January 2025
Summary
CVE-2025-23627 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-23627 is a Cross-Site Request Forgery (CSRF) vulnerability, mapped to CWE-352, in the frenchsquared Comment-Emailer WordPress plugin, affecting all versions from n/a through 1.0.5. The flaw enables Stored Cross-Site Scripting (XSS) when exploited via CSRF, as documented in the CVE description published on 2025-01-16.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no required privileges, though user interaction is necessary. Exploitation tricks a victim into submitting a malicious request, leading to stored XSS that can execute scripts in the context of other users viewing affected pages, achieving low impacts on confidentiality, integrity, and availability with a changed scope (CVSS:3.1 score of 7.1).
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/comment-emailer/vulnerability/wordpress-comment-emailer-plugin-1-0-5-csrf-to-stored-cross-site-scripting-vulnerability?_s_id=cve provides details on this WordPress plugin vulnerability, and security practitioners should review it for recommended mitigations such as updating the plugin or implementing CSRF protections.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3296
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in frenchsquared Comment-Emailer comment-emailer allows Stored XSS.This issue affects Comment-Emailer: from n/a through <= 1.0.5.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CSRF vulnerability in the public-facing WordPress plugin directly enables remote exploitation of the application (T1190) and facilitates stored XSS for arbitrary JavaScript execution in victim browsers (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 directly mitigates the CVE by requiring identification, reporting, and correction of the specific flaw in the Comment-Emailer plugin through patching or updates.
SC-23 enforces session authenticity mechanisms like anti-CSRF tokens, directly preventing unauthenticated attackers from tricking users into submitting malicious requests via CSRF.
SI-10 requires validation of information inputs to block malicious payloads that lead to stored XSS when exploited through the CSRF vulnerability.