CVE-2025-23743
Published: 16 January 2025
Summary
CVE-2025-23743 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-23743 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Social Analytics WordPress plugin developed by MartijnScheijbeler. This flaw allows for Stored Cross-Site Scripting (XSS) and affects all versions of the plugin from its initial release through 0.2 inclusive. The vulnerability received a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility and scope change.
Attackers can exploit this vulnerability remotely with low complexity and no required privileges, though it necessitates user interaction, such as luring an authenticated WordPress user to a malicious site. By crafting a CSRF payload, an attacker can trick the victim into submitting a request that injects a stored XSS payload into the plugin, which then executes in the context of the site for other users, potentially leading to low-level impacts on confidentiality, integrity, and availability.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/social-analytics/vulnerability/wordpress-social-analytics-plugin-0-2-csrf-to-stored-xss-vulnerability?_s_id=cve) documents this issue in the Social Analytics plugin version 0.2 and provides further technical details for practitioners.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3382
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in MartijnScheijbeler Social Analytics social-analytics allows Stored XSS.This issue affects Social Analytics: from n/a through <= 0.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF to stored XSS in public-facing WordPress plugin directly enables remote exploitation of public-facing applications (T1190) and facilitates arbitrary JavaScript execution in victim browsers via the injected payload (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 requires mechanisms like anti-CSRF tokens to protect session authenticity, directly preventing the forged requests that exploit this CSRF vulnerability to inject stored XSS.
SI-10 mandates validation of information inputs, preventing acceptance and storage of malicious XSS payloads submitted via the CSRF attack.
SI-15 enforces output filtering, blocking execution of any stored XSS payloads injected through the CSRF vulnerability when rendered to users.