CVE-2025-23982
Published: 27 January 2025
Summary
CVE-2025-23982 is a high-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-23982 is a Missing Authorization vulnerability (CWE-862) in the Fare Calculator WordPress plugin developed by Gopi Krishnan, which enables Stored XSS. The vulnerability affects the fare-calculator plugin in all versions up to and including 1.1.
Unauthenticated attackers can exploit this issue remotely with low attack complexity and no required privileges, though user interaction is necessary. Exploitation typically involves CSRF to inject a malicious payload without authorization, resulting in stored XSS that executes in the context of other users viewing affected content. This can lead to low impacts on confidentiality, integrity, and availability, with a changed scope, as reflected in the CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
The Patchstack advisory provides details on this CSRF-to-Stored XSS vulnerability in Fare Calculator version 1.1, including recommended mitigations: https://patchstack.com/database/Wordpress/Plugin/fare-calculator/vulnerability/wordpress-fare-calculator-plugin-1-1-csrf-to-stored-cross-site-scripting-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3581
Vulnerability details
Missing Authorization vulnerability in Gopi krishnan Fare Calculator fare-calculator allows Stored XSS.This issue affects Fare Calculator: from n/a through <= 1.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The missing authorization vuln in the public-facing WordPress plugin directly enables exploitation of the application (T1190) to inject a stored XSS payload, which facilitates arbitrary JavaScript execution in victim browsers (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations to prevent unauthenticated attackers from injecting stored XSS payloads via missing authorization in the Fare Calculator plugin.
Validates and sanitizes inputs to block malicious JavaScript payloads exploited through CSRF leading to stored XSS.
Filters and encodes outputs to neutralize stored XSS payloads when affected content is viewed by other users.