CVE-2025-23694

High

Published: 16 January 2025

Published

16 January 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS Score 0.0021 42.7th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-23694 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-23694 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Shabbos and Yom Tov WordPress plugin developed by shabboscommerce. This flaw enables Stored XSS and affects all versions of the plugin up to and including 1.9, with no known lower bound specified.

Unauthenticated attackers (PR:N) can exploit the vulnerability remotely over the network (AV:N) with low attack complexity (AC:L), though it requires user interaction (UI:R) such as tricking an administrator into submitting a malicious request. Successful exploitation changes the scope to high (S:C), allowing attackers to inject and store malicious scripts that execute in the context of other users viewing affected pages, resulting in low impacts to confidentiality, integrity, and availability (C:L/I:L/A:L) for a CVSS v3.1 base score of 7.1.

The Patchstack advisory documents this CSRF-to-Stored XSS issue in the Shabbos and Yom Tov plugin version 1.9 and provides details on the vulnerability for WordPress site operators.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-3350

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in shabboscommerce Shabbos and Yom Tov shabbos-and-yom-tov allows Stored XSS.This issue affects Shabbos and Yom Tov: from n/a through <= 1.9.

CWE(s): CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.007 JavaScript Execution

Adversaries may abuse various implementations of JavaScript for execution.

attack.mitre.org →

Why these techniques?

CSRF-to-Stored XSS in public-facing WordPress plugin enables T1190 for remote exploitation of the application and facilitates T1059.007 via injection of executable JavaScript payloads in user browsers.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1