CVE-2025-23745

High

Published: 16 January 2025

Published

16 January 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS Score 0.0021 42.7th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-23745 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-23745 is a Cross-Site Request Forgery (CSRF) vulnerability in the Call me Now WordPress plugin by Tussendoor B.V., which enables Stored Cross-Site Scripting (XSS). The issue affects the plugin from unknown initial versions through 1.0.5 and is associated with CWE-352.

Attackers require no privileges and can exploit this over the network with low complexity, though user interaction is needed. Per the CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), exploitation changes scope and yields low impacts on confidentiality, integrity, and availability. Unauthenticated attackers can forge requests to trick users into injecting and storing XSS payloads, which then execute for subsequent visitors.

The Patchstack advisory provides further details on this WordPress plugin vulnerability, including assessment and recommended actions.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-3383

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in Tussendoor B.V. Call me Now call-me-now allows Stored XSS.This issue affects Call me Now: from n/a through <= 1.0.5.

CWE(s): CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.007 JavaScript Execution

Adversaries may abuse various implementations of JavaScript for execution.

attack.mitre.org →

Why these techniques?

CSRF in public-facing WordPress plugin directly enables exploitation of public-facing applications (T1190) to store and execute XSS payloads, facilitating JavaScript execution (T1059.007) in victim browsers.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1