CVE-2025-24561
Published: 24 January 2025
Summary
CVE-2025-24561 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-24561 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the ReviewsTap WordPress plugin developed by awcode. This flaw enables Stored Cross-Site Scripting (XSS) and affects all versions of ReviewsTap up to and including 1.1.2. The vulnerability received a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), highlighting its network accessibility, low attack complexity, lack of required privileges, and dependence on user interaction, with impacts across confidentiality, integrity, and availability in a changed scope.
Attackers can exploit this vulnerability remotely without authentication by crafting a malicious webpage or link that, when visited by a legitimate user (such as a site administrator), triggers a CSRF request to the vulnerable ReviewsTap plugin. This allows the storage of an XSS payload, which executes in the context of the plugin for subsequent users or admins viewing affected content, potentially leading to session hijacking, data theft, or further site compromise.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/reviewstap/vulnerability/wordpress-reviewstap-plugin-1-1-2-csrf-to-stored-cross-site-scripting-vulnerability?_s_id=cve details the CSRF-to-Stored XSS issue in ReviewsTap version 1.1.2 and earlier, recommending updates to a fixed version of the plugin for mitigation. Security practitioners should verify plugin updates via the official WordPress repository and implement CSRF protections where possible.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3769
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in awcode ReviewsTap reviewstap allows Stored XSS.This issue affects ReviewsTap: from n/a through <= 1.1.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in public-facing WordPress plugin directly enables T1190; stored XSS facilitates T1185 browser session hijacking; exploitation via crafted malicious link or page matches T1204.001.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 requires session authenticity tokens that directly prevent CSRF attacks by validating requests, stopping the forged submission of XSS payloads in ReviewsTap.
SI-10 enforces information input validation at entry points, blocking malicious XSS payloads from being stored via the CSRF vulnerability in the plugin.
SI-2 mandates timely flaw remediation, such as patching the vulnerable ReviewsTap plugin to version beyond 1.1.2 as recommended by Patchstack.