Cyber Resilience

CVE-2025-23884

High

Published: 16 January 2025

Published
16 January 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0011 28.2th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-23884 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-23884 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Annie WordPress plugin developed by Chris Roberts. This issue affects Annie from unknown initial versions through version 2.1.1. The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), highlighting its potential for cross-site exploitation with changed scope.

Unauthenticated attackers can exploit this vulnerability remotely with low attack complexity, requiring only user interaction such as tricking a victim into visiting a malicious webpage. Successful CSRF exploitation enables the attacker to perform unauthorized actions on behalf of the authenticated user, potentially leading to low impacts on confidentiality, integrity, and availability.

The Patchstack advisory details this as a CSRF-to-stored-XSS vulnerability in WordPress Annie plugin version 2.1.1, providing vulnerability assessment and recommendations for affected sites. Security practitioners should consult the advisory at https://patchstack.com/database/Wordpress/Plugin/annie/vulnerability/wordpress-annie-plugin-2-1-1-csrf-to-stored-xss-vulnerability?_s_id=cve for mitigation guidance, including plugin updates where available.

EU & UK References

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in Chris Roberts Annie annie allows Cross Site Request Forgery.This issue affects Annie: from n/a through <= 2.1.1.

CWE(s)
CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1204.001 Malicious Link Execution
An adversary may rely upon a user clicking a malicious link in order to gain execution.
attack.mitre.org →
Why these techniques?

CSRF-to-stored-XSS in public-facing WordPress plugin exploited remotely via malicious link requiring user interaction to perform unauthorized actions.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-25121Shared CWE-352
CVE-2025-24001Shared CWE-352
CVE-2025-25147Shared CWE-352
CVE-2026-34904Shared CWE-352
CVE-2024-26153Shared CWE-352
CVE-2025-28860Shared CWE-352
CVE-2026-45430Shared CWE-352
CVE-2025-23880Shared CWE-352
CVE-2025-59541Shared CWE-352
CVE-2026-23622Shared CWE-352

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly mitigates the CVE by requiring timely identification, reporting, and patching of the CSRF vulnerability in the Annie WordPress plugin.

SC-23 Session Authenticity good match
prevent

Enforces session authenticity mechanisms such as anti-CSRF tokens to prevent unauthorized actions via forged requests on behalf of authenticated users.

SI-10 Information Input Validation good match
prevent

Requires validation of information inputs, including CSRF tokens, to block exploitation of the cross-site request forgery vulnerability.

References