CVE-2025-23698
Published: 16 January 2025
Summary
CVE-2025-23698 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-23698 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the WP Custom Google Search WordPress plugin developed by ivanra10. This flaw enables Stored XSS and affects all versions of the plugin from n/a through 1.0 inclusive. Published on 2025-01-16, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility and scope change.
The vulnerability can be exploited by unauthenticated attackers over the network with low attack complexity, though it requires user interaction from an authenticated victim, such as a site administrator. By tricking the victim into performing a malicious request via a forged page, attackers can inject and store XSS payloads, potentially leading to script execution in the context of the WordPress site, with low impacts on confidentiality, integrity, and availability.
Patchstack's advisory provides details on the vulnerability in the WP Custom Google Search plugin version 1.0, recommending mitigation through plugin updates where available or removal of the affected plugin. Security practitioners should consult https://patchstack.com/database/Wordpress/Plugin/wp-custom-google-search/vulnerability/wordpress-wp-custom-google-search-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve for full remediation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3354
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in ivanra10 WP Custom Google Search wp-custom-google-search allows Stored XSS.This issue affects WP Custom Google Search: from n/a through <= 1.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF to stored XSS in public-facing WordPress plugin directly enables exploitation of the web application (T1190) and arbitrary JavaScript execution via the injected XSS payload (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of the specific CSRF-to-stored XSS flaw in the WP Custom Google Search plugin through patching or removal.
Enforces validation of plugin inputs to block malicious XSS payloads from being accepted and stored via forged CSRF requests.
Filters outputs from the plugin to prevent execution of any XSS scripts stored due to the CSRF vulnerability.