Cyber Resilience

CVE-2025-23872

High

Published: 16 January 2025

Published
16 January 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0014 33.7th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-23872 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-23872 is a Cross-Site Request Forgery (CSRF) vulnerability in the PayForm WordPress plugin that allows Stored Cross-Site Scripting (XSS). This issue affects PayForm versions from n/a through <= 2.0 and is associated with CWE-352. The vulnerability was published on 2025-01-16.

The CVSS v3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no privileges required, and user interaction needed, with changed scope and low impacts on confidentiality, integrity, and availability. Unauthenticated attackers can exploit it by tricking users into performing unintended actions, leading to stored XSS execution.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/payform/vulnerability/wordpress-payform-plugin-2-0-csrf-to-stored-xss-vulnerability?_s_id=cve.

EU & UK References

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in payform PayForm payform allows Stored XSS.This issue affects PayForm: from n/a through <= 2.0.

CWE(s)
CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1204.001 Malicious Link Execution
An adversary may rely upon a user clicking a malicious link in order to gain execution.
attack.mitre.org →
Why these techniques?

Vulnerability in public-facing WordPress plugin enables exploitation of public-facing applications (T1190). CSRF requires tricking users via malicious link to trigger unintended actions leading to stored XSS (T1204.001).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-25121Shared CWE-352
CVE-2025-24001Shared CWE-352
CVE-2025-25147Shared CWE-352
CVE-2026-34904Shared CWE-352
CVE-2024-26153Shared CWE-352
CVE-2025-28860Shared CWE-352
CVE-2026-45430Shared CWE-352
CVE-2025-23880Shared CWE-352
CVE-2025-59541Shared CWE-352
CVE-2026-23622Shared CWE-352

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SC-23 Session Authenticity good match
prevent

SC-23 enforces session authenticity mechanisms such as anti-CSRF tokens, directly preventing the cross-site request forgery that enables stored XSS in this PayForm plugin vulnerability.

SI-10 Information Input Validation good match
prevent

SI-10 requires validation of all information inputs, blocking malicious XSS payloads from being stored via forged CSRF requests in the vulnerable PayForm versions.

SI-2 Flaw Remediation good match
prevent

SI-2 mandates timely identification, reporting, and correction of flaws, directly mitigating this known CSRF-to-stored XSS vulnerability by patching PayForm <=2.0.

References