CVE-2025-23803

High

Published: 22 January 2025

Published

22 January 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS Score 0.0010 28.0th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-23803 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-23803 is a Cross-Site Request Forgery (CSRF) vulnerability in the Snippy WordPress plugin developed by Rik Schennink. The issue affects Snippy versions from n/a through 1.4.1 and enables Reflected Cross-Site Scripting (XSS). Published on 2025-01-22, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and maps to CWE-352.

Remote attackers require no privileges to exploit this vulnerability, but user interaction is necessary, such as an authenticated victim visiting a malicious site. The attacker can craft a webpage that forges a CSRF request to the Snippy plugin, triggering reflected XSS in the user's browser. This changes the scope of impact, allowing limited confidentiality, integrity, and availability effects, such as potential session token theft or malicious script execution within the plugin's context.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/snippy/vulnerability/wordpress-snippy-plugin-1-4-1-csrf-to-cross-site-scripting-xss-vulnerability?_s_id=cve provides details on the CSRF-to-XSS vulnerability in Snippy version 1.4.1 for WordPress. Security practitioners should consult this reference for recommended mitigations.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-3435

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in Rik Schennink Snippy snippy allows Reflected XSS.This issue affects Snippy: from n/a through <= 1.4.1.

CWE(s): CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

The vulnerability is a CSRF leading to reflected XSS in a public-facing WordPress plugin, directly enabling remote exploitation of an internet-facing application without authentication.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1