CVE-2025-23702
Published: 16 January 2025
Summary
CVE-2025-23702 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-23702 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Anonymize Links by Schalk Burger, affecting all versions from n/a through 1.1. The flaw enables Stored Cross-Site Scripting (XSS) and is classified under CWE-352. It carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility with low attack complexity, no required privileges, user interaction, changed scope, and low impacts to confidentiality, integrity, and availability. The vulnerability was published on 2025-01-16.
Unauthenticated attackers can exploit this CSRF issue by tricking authenticated users into submitting malicious requests, resulting in the storage of XSS payloads. This allows arbitrary script execution in the context of the plugin for subsequent site visitors, with potential for low-level impacts across confidentiality, integrity, and availability due to the expanded scope.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/anonymize-links/vulnerability/wordpress-anonymize-links-plugin-1-1-csrf-to-stored-xss-vulnerability?_s_id=cve) provides details on the vulnerability in the Anonymize Links plugin version 1.1. Security practitioners should consult this reference for mitigation recommendations, including patching to a fixed version beyond 1.1.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3358
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in Schalk Burger Anonymize Links anonymize-links allows Stored XSS.This issue affects Anonymize Links: from n/a through <= 1.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a CSRF vulnerability in a public-facing WordPress plugin that enables stored XSS, directly matching exploitation of public-facing applications for initial access and code injection.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces session authenticity mechanisms like anti-CSRF tokens to prevent unauthenticated attackers from tricking users into submitting malicious requests that store XSS payloads.
Requires validation of information inputs to sanitize and block malicious XSS payloads submitted via CSRF requests before storage.
Filters information outputs to prevent execution of any stored XSS payloads by subsequent site visitors.