CVE-2025-23801
Published: 16 January 2025
Summary
CVE-2025-23801 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces session authenticity mechanisms like CSRF tokens to prevent forged requests that store XSS payloads.
Validates inputs to block malicious XSS payloads from being accepted and stored via the CSRF vector.
Filters outputs to neutralize stored XSS payloads before they are rendered and executed in users' browsers.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a remote CSRF-to-stored-XSS vulnerability in a public-facing WordPress plugin, directly enabling exploitation of public-facing applications.
NVD Description
Cross-Site Request Forgery (CSRF) vulnerability in FuzzGuard Style Admin style-admin allows Stored XSS.This issue affects Style Admin: from n/a through <= 1.4.3.
Deeper analysisAI
CVE-2025-23801 is a Cross-Site Request Forgery (CSRF) vulnerability in the FuzzGuard Style Admin (style-admin) WordPress plugin that allows Stored Cross-Site Scripting (XSS). This issue affects all versions of the plugin from n/a through 1.4.3 inclusive. Published on 2025-01-16, the vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and maps to CWE-352.
Remote attackers without privileges can exploit this vulnerability by tricking authenticated users, such as site administrators, into interacting with a malicious webpage (UI:R). This user interaction enables a CSRF attack that results in the storage of XSS payloads on the target site, potentially leading to low-level impacts on confidentiality, integrity, and availability with a changed scope (S:C).
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/style-admin/vulnerability/wordpress-style-admin-plugin-1-4-3-csrf-to-stored-xss-vulnerability?_s_id=cve details the CSRF-to-Stored XSS vulnerability in the Style Admin WordPress plugin version 1.4.3 and earlier.
Details
- CWE(s)