CVE-2025-23673
Published: 16 January 2025
Summary
CVE-2025-23673 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-23673 is a Cross-Site Request Forgery (CSRF) vulnerability in the dkukral Email on Publish WordPress plugin, which allows Stored Cross-Site Scripting (XSS). This issue affects the plugin from its initial release through version 1.5 inclusive.
The vulnerability can be exploited by remote attackers with no required privileges, provided they can trick an authenticated user into performing an action via a malicious webpage, as indicated by the CVSS v3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (base score 7.1). Exploitation enables the storage of XSS payloads through CSRF, potentially leading to low impacts on confidentiality, integrity, and availability with changed scope.
The Patchstack advisory documents this CSRF to Stored XSS vulnerability specifically in Email on Publish version 1.5, providing further technical details at https://patchstack.com/database/Wordpress/Plugin/email-on-publish/vulnerability/wordpress-email-on-publish-plugin-1-5-csrf-to-stored-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3332
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in dkukral Email on Publish email-on-publish allows Stored XSS.This issue affects Email on Publish: from n/a through <= 1.5.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF to stored XSS in public-facing WordPress plugin directly enables T1190 exploitation of the web app and T1059.007 JavaScript execution via injected payloads.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the CSRF to Stored XSS flaw in the Email on Publish WordPress plugin by identifying, reporting, and applying patches or updates to affected versions <=1.5.
Enforces session authenticity mechanisms such as anti-CSRF tokens to prevent attackers from tricking authenticated users into submitting malicious requests that store XSS payloads.
Validates and sanitizes information inputs to the plugin to block malicious XSS payloads from being accepted and stored via CSRF exploitation.