Cyber Resilience

CVE-2025-23827

High

Published: 16 January 2025

Published
16 January 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0035 57.6th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-23827 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 42.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2025-23827 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Stored Cross-site Scripting (XSS) under CWE-79, affecting the Strx Magic Floating Sidebar Maker WordPress plugin (strx-magic-floating-sidebar-maker). The issue impacts all versions up to and including 1.4.1, as published on 2025-01-16.

Unauthenticated attackers (PR:N) with network access (AV:N) can exploit this vulnerability, which has low attack complexity (AC:L) but requires user interaction (UI:R). Exploitation changes scope (S:C), enabling limited impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), for an overall CVSS v3.1 score of 7.1. The vulnerability manifests as CSRF leading to Stored XSS, allowing injected scripts to persist and execute in the browsers of site visitors.

The Patchstack advisory provides details on this CSRF-to-Stored XSS vulnerability in Strx Magic Floating Sidebar Maker plugin version 1.4.1, available at https://patchstack.com/database/Wordpress/Plugin/strx-magic-floating-sidebar-maker/vulnerability/wordpress-strx-magic-floating-sidebar-maker-plugin-1-4-1-csrf-to-stored-xss-vulnerability?_s_id=cve.

EU & UK References

Vulnerability details

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in straps Strx Magic Floating Sidebar Maker strx-magic-floating-sidebar-maker allows Stored XSS.This issue affects Strx Magic Floating Sidebar Maker: from n/a through <= 1.4.1.

CWE(s)
CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
attack.mitre.org →
Why these techniques?

Stored XSS in public-facing WordPress plugin directly enables exploitation of public-facing applications (T1190) and client-side JavaScript execution in visitor browsers (T1059.007).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-3231Shared CWE-79
CVE-2025-23481Shared CWE-79
CVE-2025-69302Shared CWE-79
CVE-2025-23734Shared CWE-79
CVE-2025-23571Shared CWE-79
CVE-2025-65110Shared CWE-79
CVE-2026-24948Shared CWE-79
CVE-2025-27352Shared CWE-79
CVE-2025-30349Shared CWE-79
CVE-2026-3876Shared CWE-79

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly addresses improper neutralization of input by validating and sanitizing user inputs to the WordPress plugin, preventing stored XSS injection.

SI-15 Information Output Filtering good match
prevent

Filters potentially malicious content like scripts from plugin-generated web page outputs, blocking stored XSS execution in victim browsers.

SI-2 Flaw Remediation good match
prevent

Mandates identification, reporting, and patching of the specific flaw in Strx Magic Floating Sidebar Maker versions up to 1.4.1.

References