CVE-2025-23869
Published: 16 January 2025
Summary
CVE-2025-23869 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-23869 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the CJ Custom Content WordPress plugin (cj-custom-content) developed by shibulijack. This flaw enables Stored Cross-Site Scripting (XSS) and affects all versions from unknown initial release through 2.0 inclusive. The vulnerability received a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility, low complexity, lack of required privileges, and scope change despite requiring user interaction.
Unauthenticated attackers can exploit this vulnerability by crafting a malicious webpage that, when visited by a legitimate user (such as an administrator), triggers a CSRF request to the vulnerable plugin endpoint. This stores a malicious XSS payload persistently within the site's content. Once stored, the payload executes in the context of other users' browsers, potentially leading to session hijacking, data theft, or further site compromise, with low impacts on confidentiality, integrity, and availability.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/cj-custom-content/vulnerability/wordpress-cj-custom-content-plugin-2-0-csrf-to-cross-site-scripting-vulnerability?_s_id=cve) documents this CSRF-to-XSS issue in the CJ Custom Content plugin version 2.0 for WordPress.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3490
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in shibulijack CJ Custom Content cj-custom-content allows Stored XSS.This issue affects CJ Custom Content: from n/a through <= 2.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CSRF-to-stored-XSS vulnerability in a public-facing WordPress plugin directly enables exploitation of public-facing applications (T1190) and facilitates browser session hijacking (T1185) via persistent malicious JavaScript execution in user browsers.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 protects against cross-site request forgery attacks by ensuring session authenticity, directly mitigating the CSRF mechanism used to store the malicious XSS payload.
SI-10 enforces input validation to reject malicious XSS payloads submitted via the vulnerable plugin endpoint, preventing storage of exploitable content.
SI-15 applies output filtering and encoding to neutralize stored XSS payloads when rendered, blocking execution even if malicious content is stored.