CVE-2025-23692

High

Published: 16 January 2025

Published

16 January 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS Score 0.0016 36.9th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-23692 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-23692 is a Cross-Site Request Forgery (CSRF) vulnerability in the artanik Slider for Writers WordPress plugin (slider-for-writers) that allows Stored XSS. This issue affects the plugin from unknown initial versions through version 1.3 inclusive.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no privileges required, and user interaction needed. An unauthenticated attacker can exploit it by tricking an authenticated user—such as a site administrator—into visiting a malicious webpage that submits a forged request to the plugin. This stores an XSS payload persistently, which executes in the victim's browser context when viewing affected slider content, enabling limited impacts on confidentiality, integrity, and availability with a changed scope.

Patchstack documents the vulnerability in detail for the Slider for Writers plugin version 1.3 at https://patchstack.com/database/Wordpress/Plugin/slider-for-writers/vulnerability/wordpress-slider-for-writers-plugin-1-3-csrf-to-stored-xss-vulnerability?_s_id=cve.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-3348

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in artanik Slider for Writers slider-for-writers allows Stored XSS.This issue affects Slider for Writers: from n/a through <= 1.3.

CWE(s): CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.007 JavaScript Execution

Adversaries may abuse various implementations of JavaScript for execution.

attack.mitre.org →

Why these techniques?

Vulnerability in public-facing WordPress plugin enables exploitation via T1190; CSRF to stored XSS directly facilitates JavaScript execution in browser context via T1059.007.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1