CVE-2025-23661
Published: 16 January 2025
Summary
CVE-2025-23661 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-23661 is a Cross-Site Request Forgery (CSRF) vulnerability in the NV Slider WordPress plugin by ryscript (nv-slider), which enables Stored Cross-Site Scripting (XSS). This issue affects all versions of the plugin from n/a through 1.6 inclusive. The vulnerability is classified under CWE-352 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no privileges required, user interaction needed, changed scope, and low impacts across confidentiality, integrity, and availability.
An attacker can exploit this vulnerability remotely without authentication by tricking a logged-in user (such as an administrator) into interacting with a malicious webpage or link that submits a forged request to the vulnerable plugin endpoint. This CSRF action injects a stored XSS payload into slider content, which then executes arbitrary JavaScript in the browsers of subsequent users viewing the affected sliders, potentially leading to session hijacking, data theft, or further site compromise.
Patchstack's advisory documents this CSRF-to-Stored XSS vulnerability specifically in NV Slider version 1.6 and provides details on affected installations: https://patchstack.com/database/Wordpress/Plugin/nv-slider/vulnerability/wordpress-nv-slider-plugin-1-6-csrf-to-stored-cross-site-scripting-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3325
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in ryscript NV Slider nv-slider allows Stored XSS.This issue affects NV Slider: from n/a through <= 1.6.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CSRF-to-Stored XSS vulnerability in the public-facing NV Slider WordPress plugin enables exploitation of a public-facing application (T1190) via a malicious link or webpage that tricks an authenticated user into submitting a forged request (T1204.001).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 requires session authenticity mechanisms like anti-CSRF tokens to prevent forged requests from injecting stored XSS payloads into the NV Slider plugin.
SI-10 enforces input validation and sanitization of slider content to block malicious JavaScript payloads from being stored via CSRF exploitation.
SI-15 applies output filtering and encoding to slider content, preventing execution of any stored XSS payloads in users' browsers.