CVE-2025-23659
Published: 16 January 2025
Summary
CVE-2025-23659 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-23659 is a Cross-Site Request Forgery (CSRF) vulnerability in the MercadoLibre Integration WordPress plugin (mercadolibre-integration) developed by hernanjh. The flaw allows for Stored XSS and affects all versions up to and including 1.1. It is classified under CWE-352 with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges, and scope change.
Attackers can exploit this vulnerability remotely without authentication by tricking authenticated users into interacting with a malicious webpage or link that submits a forged request to the vulnerable plugin. This user interaction (UI:R) enables the storage of malicious XSS payloads, which can then execute in the context of other users viewing affected pages, potentially leading to low-level impacts on confidentiality, integrity, and availability, such as session hijacking, data theft, or site defacement.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/mercadolibre-integration/vulnerability/wordpress-mercadolibre-integration-plugin-1-1-csrf-to-stored-cross-site-scripting-vulnerability?_s_id=cve provides details on the vulnerability, including recommended mitigations such as updating to a patched version beyond 1.1 or applying available security configurations for WordPress sites using this plugin.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3323
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in hernanjh MercadoLibre Integration mercadolibre-integration allows Stored XSS.This issue affects MercadoLibre Integration: from n/a through <= 1.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF to stored XSS in public-facing WordPress plugin directly enables T1190 (exploit public-facing app); exploited via malicious link (T1204.001) leading to stored XSS that facilitates browser session hijacking (T1185).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 enforces session authenticity protections like anti-CSRF tokens, directly preventing forged requests that exploit the CSRF vulnerability to store XSS payloads.
SI-10 requires validation of information inputs, blocking malicious XSS payloads from being accepted and stored via the vulnerable plugin endpoint.
SI-15 mandates output filtering and encoding, preventing execution of any stored XSS payloads when affected pages are viewed by users.