CVE-2025-23818

High

Published: 16 January 2025

Published

16 January 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS Score 0.0014 33.7th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-23818 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-23818 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the More Link Modifier WordPress plugin developed by pyko (slug: more-link-modifier) that enables Stored Cross-Site Scripting (XSS). The issue affects all versions of the plugin from its initial release through 1.0.3. Published on January 16, 2025, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to network accessibility and scope change.

Unauthenticated attackers can exploit this vulnerability remotely with low attack complexity by tricking authenticated users, such as site administrators, into performing unintended actions via malicious requests (user interaction required). Exploitation results in stored XSS payloads being injected, potentially allowing attackers to steal session cookies, impersonate users, or execute arbitrary scripts in the context of affected users, with low impacts on confidentiality, integrity, and availability but elevated risk from the cross-site scope change.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/more-link-modifier/vulnerability/wordpress-more-link-modifier-plugin-1-0-3-csrf-to-cross-site-scripting-vulnerability?_s_id=cve documents the CSRF-to-XSS issue in More Link Modifier 1.0.3 and provides mitigation guidance for WordPress site operators.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-3448

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in pyko More Link Modifier more-link-modifier allows Stored XSS.This issue affects More Link Modifier: from n/a through <= 1.0.3.

CWE(s): CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1185 Browser Session Hijacking Collection

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.

attack.mitre.org →

T1539 Steal Web Session Cookie Credential Access

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.

attack.mitre.org →

Why these techniques?

Public-facing WordPress plugin vuln enables T1190 exploitation; stored XSS directly facilitates browser session hijacking (T1185) and stealing web session cookies (T1539) as described.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1