CVE-2025-23872
Published: 16 January 2025
Summary
CVE-2025-23872 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SC-23 enforces session authenticity mechanisms such as anti-CSRF tokens, directly preventing the cross-site request forgery that enables stored XSS in this PayForm plugin vulnerability.
SI-10 requires validation of all information inputs, blocking malicious XSS payloads from being stored via forged CSRF requests in the vulnerable PayForm versions.
SI-2 mandates timely identification, reporting, and correction of flaws, directly mitigating this known CSRF-to-stored XSS vulnerability by patching PayForm <=2.0.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in public-facing WordPress plugin enables exploitation of public-facing applications (T1190). CSRF requires tricking users via malicious link to trigger unintended actions leading to stored XSS (T1204.001).
NVD Description
Cross-Site Request Forgery (CSRF) vulnerability in payform PayForm payform allows Stored XSS.This issue affects PayForm: from n/a through <= 2.0.
Deeper analysisAI
CVE-2025-23872 is a Cross-Site Request Forgery (CSRF) vulnerability in the PayForm WordPress plugin that allows Stored Cross-Site Scripting (XSS). This issue affects PayForm versions from n/a through <= 2.0 and is associated with CWE-352. The vulnerability was published on 2025-01-16.
The CVSS v3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no privileges required, and user interaction needed, with changed scope and low impacts on confidentiality, integrity, and availability. Unauthenticated attackers can exploit it by tricking users into performing unintended actions, leading to stored XSS execution.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/payform/vulnerability/wordpress-payform-plugin-2-0-csrf-to-stored-xss-vulnerability?_s_id=cve.
Details
- CWE(s)