CVE-2025-23989
Published: 31 January 2025
Summary
CVE-2025-23989 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-23989 is a Cross-Site Request Forgery (CSRF) vulnerability, mapped to CWE-352, in the Internal Link Builder WordPress plugin developed by Alessandro Piconi. The issue affects all versions of the plugin from n/a through 1.0 inclusive. Published on 2025-01-31, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), reflecting network accessibility, low attack complexity, no required privileges, user interaction dependency, changed scope, and low impacts on confidentiality, integrity, and availability.
An unauthenticated attacker can exploit this vulnerability remotely by tricking an authenticated user, typically a site administrator, into visiting a malicious webpage that submits forged requests to the plugin. This enables the attacker to perform unauthorized actions on behalf of the victim, potentially leading to stored cross-site scripting (XSS) as indicated in vulnerability details.
The Patchstack advisory documents this as a CSRF-to-stored-XSS vulnerability in Internal Link Builder version 1.0 and provides details at https://patchstack.com/database/Wordpress/Plugin/internal-link-builder/vulnerability/wordpress-internal-link-builder-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve. Security practitioners should consult this reference for mitigation guidance, such as updating the plugin or implementing CSRF protections.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3585
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in Alessandro Piconi Internal Link Builder internal-link-builder allows Cross Site Request Forgery.This issue affects Internal Link Builder: from n/a through <= 1.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF-to-stored-XSS in public-facing WordPress plugin directly enables exploitation of web application (T1190) and allows arbitrary JavaScript execution in victim browsers (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces session authenticity mechanisms such as anti-CSRF tokens to prevent forged requests that exploit the plugin's CSRF vulnerability on behalf of authenticated users.
Requires timely remediation of the specific CSRF flaw in the Internal Link Builder plugin through patching, directly eliminating the vulnerability.
Validates information inputs to the plugin endpoints to block malicious payloads that could lead to stored XSS via the CSRF attack vector.