CVE-2025-23848
Published: 16 January 2025
Summary
CVE-2025-23848 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-23848 is a Cross-Site Request Forgery (CSRF) vulnerability in the Hotspots Analytics WordPress plugin developed by dpowney, which enables Stored XSS. The flaw affects the plugin from its initial versions through 4.0.12, as documented under CWE-352. It was published on 2025-01-16 with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Attackers can exploit this vulnerability remotely over the network with low attack complexity and no required privileges, though it depends on user interaction. An unauthenticated adversary can craft a malicious webpage or link that, when visited by an authenticated WordPress administrator, triggers a CSRF request to store a malicious XSS payload in the plugin. Successful exploitation leads to low impacts on confidentiality, integrity, and availability, elevated by the changed scope (S:C), potentially allowing session hijacking or further site compromise via the stored script.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/hotspots/vulnerability/wordpress-hotspots-analytics-plugin-4-0-12-csrf-to-stored-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3473
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in dpowney Hotspots Analytics hotspots allows Stored XSS.This issue affects Hotspots Analytics: from n/a through <= 4.0.12.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a CSRF vulnerability in a public-facing WordPress plugin enabling stored XSS, which is directly exploitable as an attack on a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely remediation of flaws, directly addressing this CVE by patching the vulnerable Hotspots Analytics plugin to fix the CSRF-to-stored XSS issue.
SC-23 enforces session authenticity mechanisms like anti-CSRF tokens, preventing unauthenticated attackers from tricking admins into storing XSS payloads via forged requests.
SI-10 mandates validation of inputs such as web forms, mitigating the stored XSS aspect by rejecting malicious scripts even if a CSRF request succeeds.