Cyber Resilience

CVE-2025-24561

High

Published: 24 January 2025

Published
24 January 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0014 33.5th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-24561 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-24561 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the ReviewsTap WordPress plugin developed by awcode. This flaw enables Stored Cross-Site Scripting (XSS) and affects all versions of ReviewsTap up to and including 1.1.2. The vulnerability received a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), highlighting its network accessibility, low attack complexity, lack of required privileges, and dependence on user interaction, with impacts across confidentiality, integrity, and availability in a changed scope.

Attackers can exploit this vulnerability remotely without authentication by crafting a malicious webpage or link that, when visited by a legitimate user (such as a site administrator), triggers a CSRF request to the vulnerable ReviewsTap plugin. This allows the storage of an XSS payload, which executes in the context of the plugin for subsequent users or admins viewing affected content, potentially leading to session hijacking, data theft, or further site compromise.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/reviewstap/vulnerability/wordpress-reviewstap-plugin-1-1-2-csrf-to-stored-cross-site-scripting-vulnerability?_s_id=cve details the CSRF-to-Stored XSS issue in ReviewsTap version 1.1.2 and earlier, recommending updates to a fixed version of the plugin for mitigation. Security practitioners should verify plugin updates via the official WordPress repository and implement CSRF protections where possible.

EU & UK References

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in awcode ReviewsTap reviewstap allows Stored XSS.This issue affects ReviewsTap: from n/a through <= 1.1.2.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1185 Browser Session Hijacking Collection
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
T1204.001 Malicious Link Execution
An adversary may rely upon a user clicking a malicious link in order to gain execution.
Why these techniques?

Vulnerability in public-facing WordPress plugin directly enables T1190; stored XSS facilitates T1185 browser session hijacking; exploitation via crafted malicious link or page matches T1204.001.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-23662Shared CWE-352
CVE-2025-23659Shared CWE-352
CVE-2025-30603Shared CWE-352
CVE-2025-23499Shared CWE-352
CVE-2025-25121Shared CWE-352
CVE-2025-24001Shared CWE-352
CVE-2025-25147Shared CWE-352
CVE-2026-34904Shared CWE-352
CVE-2024-26153Shared CWE-352
CVE-2025-28860Shared CWE-352

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

SC-23 requires session authenticity tokens that directly prevent CSRF attacks by validating requests, stopping the forged submission of XSS payloads in ReviewsTap.

prevent

SI-10 enforces information input validation at entry points, blocking malicious XSS payloads from being stored via the CSRF vulnerability in the plugin.

prevent

SI-2 mandates timely flaw remediation, such as patching the vulnerable ReviewsTap plugin to version beyond 1.1.2 as recommended by Patchstack.

References