CVE-2025-23808
Published: 16 January 2025
Summary
CVE-2025-23808 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-23808 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Custom List Table Example by Dutch van Andel, affecting all versions from n/a through 1.4.1. The flaw enables Reflected Cross-Site Scripting (XSS) and is classified under CWE-352, with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
An unauthenticated attacker can exploit this over the network with low attack complexity, requiring user interaction such as visiting a malicious page. By tricking a logged-in user into submitting a forged request, the attacker triggers reflected XSS, achieving low impacts on confidentiality, integrity, and availability within a changed scope.
The Patchstack advisory documents the CSRF to Reflected XSS vulnerability in Custom List Table Example plugin version 1.4.1 and provides details for mitigation. Security practitioners should review this reference for recommended remediation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3440
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in Dutch van Andel Custom List Table Example custom-list-table-example allows Reflected XSS.This issue affects Custom List Table Example: from n/a through <= 1.4.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF to reflected XSS in public-facing WordPress plugin directly enables T1190 (exploiting public-facing app) and T1059.007 (JavaScript execution via XSS payload in victim browser).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces session authenticity mechanisms such as CSRF tokens to directly block forged requests that trigger the reflected XSS in this WordPress plugin vulnerability.
Filters information output to prevent execution of malicious scripts reflected via the CSRF exploit in the Custom List Table Example plugin.
Validates inputs to block malicious payloads from being processed and reflected as XSS through the plugin's CSRF-vulnerable endpoint.