CVE-2025-23976
Published: 31 January 2025
Summary
CVE-2025-23976 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-23976 is a Cross-Site Request Forgery (CSRF) vulnerability in the Issuu Panel WordPress plugin (issuu-panel) that enables Stored Cross-Site Scripting (XSS). This issue affects all versions of the plugin from unknown initial release through 2.1.1 and is associated with CWE-352.
The vulnerability can be exploited by unauthenticated remote attackers (AV:N/PR:N) who trick authenticated users into performing unintended actions via malicious web requests, requiring user interaction (UI:R/AC:L). Exploitation leads to the storage of XSS payloads, resulting in low impacts to confidentiality, integrity, and availability (C:L/I:L/A:L) with a changed scope (S:C), yielding a CVSS v3.1 base score of 7.1.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/issuu-panel/vulnerability/wordpress-issuu-panel-plugin-2-1-1-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3577
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in operationsissuu Issuu Panel issuu-panel allows Stored XSS.This issue affects Issuu Panel: from n/a through <= 2.1.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF to stored XSS in public-facing WordPress plugin enables T1190 (exploit public-facing app) and facilitates T1059.007 (JavaScript execution via injected XSS payload).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 enforces session authenticity mechanisms such as CSRF tokens, directly preventing unauthenticated attackers from tricking authenticated users into storing XSS payloads via forged requests in the Issuu Panel plugin.
SI-10 requires validation of all inputs to the system, blocking malicious XSS payloads from being accepted and stored through the CSRF vulnerability in Issuu Panel.
SI-15 mandates filtering and sanitization of outputs, preventing execution of any stored XSS payloads resulting from the CSRF exploitation in the Issuu Panel plugin.