CVE-2025-23832
Published: 16 January 2025
Summary
CVE-2025-23832 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-23832 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Admin Cleanup (admin-cleanup) developed by Matt Gibbs that enables Stored XSS. The issue affects all versions of the plugin from n/a through 1.0.2 inclusive. It is associated with CWE-352 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility, low complexity, lack of required privileges, and scope change.
Attackers can exploit this vulnerability remotely without authentication by tricking authenticated users, such as site administrators, into performing unintended actions via a malicious webpage (user interaction required). This CSRF leads to Stored XSS, allowing injection of malicious scripts that persist on the site and execute in the victim's browser context, potentially resulting in low-level impacts on confidentiality, integrity, and availability.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/admin-cleanup/vulnerability/wordpress-admin-cleanup-plugin-1-0-2-csrf-to-stored-xss-vulnerability?_s_id=cve documents the vulnerability details. The affected version scope implies mitigation through updating to a version beyond 1.0.2.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3461
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in Matt Gibbs Admin Cleanup admin-cleanup allows Stored XSS.This issue affects Admin Cleanup: from n/a through <= 1.0.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF to stored XSS in public-facing WordPress plugin directly enables exploitation of web application (T1190) and injection/execution of malicious JavaScript in victim browser context (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 enforces session authenticity mechanisms like anti-CSRF tokens, directly preventing forged requests that trick authenticated users into storing XSS payloads.
SI-10 requires validation of inputs to block malicious XSS scripts from being stored via the CSRF vector in the Admin Cleanup plugin.
SI-15 mandates output filtering and encoding to prevent execution of any stored XSS payloads injected through the CSRF vulnerability.