CVE-2025-23980
Published: 31 January 2025
Summary
CVE-2025-23980 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-23980 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Full Circle WordPress plugin developed by James Andrews. This flaw enables Stored Cross-Site Scripting (XSS) and affects all versions of the plugin up to and including 0.5.7.8. The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, user interaction dependency, and changed scope with low impacts across confidentiality, integrity, and availability.
Unauthenticated attackers can exploit this CSRF vulnerability by crafting malicious requests that trick authenticated users into submitting them unwittingly, such as via a malicious webpage. This allows attackers to store XSS payloads on the target site, which execute in the context of other users viewing affected content, potentially leading to session hijacking, data theft, or further site compromise depending on the payload.
The Patchstack advisory details this vulnerability and mitigation steps at https://patchstack.com/database/Wordpress/Plugin/full-circle/vulnerability/wordpress-full-circle-plugin-0-5-7-8-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3580
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in James Andrews Full Circle full-circle allows Stored XSS.This issue affects Full Circle: from n/a through <= 0.5.7.8.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in public-facing WordPress plugin directly enables exploitation of web application (T1190); stored XSS allows arbitrary JavaScript execution in victim browsers (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 requires session authenticity mechanisms like CSRF tokens to prevent unauthorized state-changing requests, directly blocking the CSRF exploitation leading to stored XSS.
SI-10 mandates validation of information inputs to reject malicious XSS payloads, preventing their storage via the CSRF vector.
SI-15 enforces output filtering and encoding to neutralize stored XSS payloads when rendered, mitigating execution even if storage occurs.