CVE-2025-23693
Published: 16 January 2025
Summary
CVE-2025-23693 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-23693 is a Cross-Site Request Forgery (CSRF) vulnerability in the uosiu Secure CAPTCHA WordPress plugin, version secure-captcha, that allows Stored Cross-Site Scripting (XSS). The issue affects the plugin from unknown initial versions through version 1.2 inclusive, as documented under CWE-352.
The vulnerability can be exploited remotely over the network (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) but user interaction (UI:R), such as tricking a user into performing an action via a malicious site. Exploitation changes the scope (S:C) and results in low impacts to confidentiality, integrity, and availability (C:L/I:L/A:L), yielding a CVSS v3.1 base score of 7.1. An attacker can leverage the CSRF to inject and store an XSS payload, which executes in the context of authenticated users viewing affected pages.
Patchstack has published an advisory detailing the CSRF to Stored XSS vulnerability in Secure CAPTCHA plugin version 1.2, available at https://patchstack.com/database/Wordpress/Plugin/secure-captcha/vulnerability/wordpress-secure-captcha-plugin-1-2-csrf-to-stored-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3349
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in uosiu Secure CAPTCHA secure-captcha allows Stored XSS.This issue affects Secure CAPTCHA: from n/a through <= 1.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF to stored XSS in public-facing WordPress plugin directly enables remote exploitation of web application (T1190) and arbitrary JavaScript execution in authenticated user browsers (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the specific CSRF to Stored XSS flaw in the Secure CAPTCHA WordPress plugin through timely identification, reporting, and patching.
Prevents CSRF exploitation by enforcing session authenticity mechanisms like anti-CSRF tokens, blocking unauthorized requests to store XSS payloads.
Validates inputs to the plugin's CAPTCHA functionality to reject malicious XSS payloads that could be stored via the CSRF vulnerability.