CVE-2025-23875
Published: 16 January 2025
Summary
CVE-2025-23875 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-23875 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the madeglobal Better Protected Pages WordPress plugin (better-protected-pages). The issue affects all versions from n/a through 1.0 and enables Stored XSS. Published on 2025-01-16, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
The vulnerability can be exploited by unauthenticated attackers over the network (AV:N) with low attack complexity (AC:L), requiring user interaction (UI:R) such as clicking a malicious link. Successful exploitation changes scope (S:C) and results in low impacts to confidentiality, integrity, and availability (C:L/I:L/A:L). Attackers can leverage CSRF to perform unauthorized actions that store XSS payloads on the site.
The Patchstack advisory provides further details on this vulnerability in the Better Protected Pages plugin version 1.0; security practitioners should consult https://patchstack.com/database/Wordpress/Plugin/better-protected-pages/vulnerability/wordpress-better-protected-pages-plugin-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve for mitigation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3496
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in madeglobal Better Protected Pages better-protected-pages allows Stored XSS.This issue affects Better Protected Pages: from n/a through <= 1.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a CSRF vulnerability in a public-facing WordPress plugin that enables Stored XSS, directly mapping to exploitation of public-facing applications (T1190) for initial access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 requires mechanisms like anti-CSRF tokens to validate session authenticity, directly preventing forged requests that exploit the CSRF vulnerability to store XSS payloads.
SI-10 enforces input validation and sanitization to reject malicious XSS payloads submitted via the CSRF vector before they are stored.
SI-15 applies output filtering and encoding to prevent execution of any stored XSS payloads resulting from the CSRF exploitation.