Cyber Resilience

CVE-2025-23720

High

Published: 16 January 2025

Published
16 January 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0021 42.7th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-23720 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-23720 is a Cross-Site Request Forgery (CSRF) vulnerability in the Web Push WordPress plugin developed by Marco Castelluccio, affecting all versions up to and including 1.4.0. The flaw enables Stored Cross-Site Scripting (XSS) attacks and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). It is classified under CWE-352.

Attackers can exploit this vulnerability over the network without requiring privileges by tricking authenticated users, such as administrators, into performing unintended actions via malicious webpages or links (user interaction required). Successful exploitation via CSRF results in the storage of XSS payloads, which can execute in the context of other users viewing affected content, achieving low confidentiality, integrity, and availability impacts with changed scope.

The Patchstack advisory documents this CSRF-to-Stored XSS issue in Web Push plugin version 1.4.0 and provides details on the vulnerability for mitigation guidance.

EU & UK References

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in Marco Castelluccio Web Push web-push allows Stored XSS.This issue affects Web Push: from n/a through <= 1.4.0.

CWE(s)
CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

CSRF vulnerability in public-facing WordPress plugin directly enables exploitation of public-facing applications over the network, leading to stored XSS.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-37102Shared CWE-352
CVE-2024-37450Shared CWE-352
CVE-2025-23558Shared CWE-352
CVE-2025-68722Shared CWE-352
CVE-2025-31440Shared CWE-352
CVE-2025-23848Shared CWE-352
CVE-2025-22571Shared CWE-352
CVE-2024-53684Shared CWE-352
CVE-2025-23455Shared CWE-352
CVE-2025-22582Shared CWE-352

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly mitigates CVE-2025-23720 by requiring timely patching of the vulnerable Web Push plugin versions up to 1.4.0 to eliminate the CSRF-to-Stored XSS flaw.

SC-23 Session Authenticity good match
prevent

Prevents CSRF exploitation in the Web Push plugin by enforcing session authenticity mechanisms such as anti-CSRF tokens to block unauthorized requests from malicious sites.

SI-10 Information Input Validation good match
prevent

Blocks Stored XSS payloads enabled by the CSRF vulnerability through validation of inputs prior to storage in the WordPress plugin.

References