CVE-2025-23717
Published: 16 January 2025
Summary
CVE-2025-23717 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SC-23 enforces session authenticity mechanisms like CSRF tokens, directly preventing unauthenticated attackers from forging requests to store XSS payloads in the vulnerable WordPress plugin.
SI-10 validates all information inputs to the plugin, blocking malicious XSS payloads from being stored via CSRF exploitation.
SI-15 filters information outputs from the plugin, preventing execution of any stored XSS payloads in the context of the WordPress site.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a CSRF vulnerability in a public-facing WordPress plugin that directly enables exploitation of the application (T1190) and facilitates stored XSS payloads that can be used for browser session hijacking (T1185).
NVD Description
Cross-Site Request Forgery (CSRF) vulnerability in itmooti Theme My Ontraport Smartform theme-my-ontraport-smartform allows Stored XSS.This issue affects Theme My Ontraport Smartform: from n/a through <= 1.2.11.
Deeper analysisAI
CVE-2025-23717 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the WordPress plugin Theme My Ontraport Smartform by itmooti. This flaw enables Stored XSS and affects all versions of the plugin up to and including 1.2.11. The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, user interaction dependency, changed scope, and low impacts across confidentiality, integrity, and availability.
Unauthenticated attackers can exploit this vulnerability remotely by tricking authenticated users into visiting a malicious webpage that submits forged requests to the vulnerable plugin. This leads to the storage of XSS payloads, which execute in the context of the WordPress site for subsequent visitors, potentially enabling session hijacking, data theft, or further site compromise depending on the payload.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/theme-my-ontraport-smartform/vulnerability/wordpress-theme-my-ontraport-smartform-plugin-1-2-11-csrf-to-stored-xss-vulnerability?_s_id=cve) documents the CSRF-to-Stored XSS issue in version 1.2.11 and provides vulnerability details for mitigation guidance.
Details
- CWE(s)