Cyber Resilience

CVE-2025-24756

High

Published: 24 January 2025

Published
24 January 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0010 27.3th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-24756 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-24756 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Roi Calculator (roi-calculator) from mgplugin that enables Stored XSS. The issue affects all versions of the plugin from unknown initial release through 1.0 inclusive. It is rated 7.1 High severity under CVSS 3.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and maps to CWE-352.

Unauthenticated attackers can exploit this vulnerability remotely with low complexity by tricking authenticated users into performing actions via a malicious request, such as through a crafted webpage or link that requires user interaction. Successful exploitation leads to Stored XSS, allowing attackers to inject and persist malicious scripts that execute in the context of other users viewing affected pages, with cross-origin scope change and low impacts to confidentiality, integrity, and availability.

The Patchstack advisory provides further details on the vulnerability, including analysis of the CSRF-to-Stored XSS chain in Roi Calculator version 1.0: https://patchstack.com/database/Wordpress/Plugin/roi-calculator/vulnerability/wordpress-roi-calculator-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve.

EU & UK References

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in mgplugin Roi Calculator roi-calculator allows Stored XSS.This issue affects Roi Calculator: from n/a through <= 1.0.

CWE(s)
CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1204.001 Malicious Link Execution
An adversary may rely upon a user clicking a malicious link in order to gain execution.
attack.mitre.org →
Why these techniques?

CSRF-to-Stored XSS in public-facing WordPress plugin directly enables T1190 (Exploit Public-Facing Application); exploitation requires tricking authenticated users via crafted link/webpage, mapping to T1204.001 (Malicious Link).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-25121Shared CWE-352
CVE-2025-24001Shared CWE-352
CVE-2025-25147Shared CWE-352
CVE-2026-34904Shared CWE-352
CVE-2024-26153Shared CWE-352
CVE-2025-28860Shared CWE-352
CVE-2026-45430Shared CWE-352
CVE-2025-23880Shared CWE-352
CVE-2025-59541Shared CWE-352
CVE-2026-23622Shared CWE-352

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly mitigates this CVE by requiring timely identification, reporting, and remediation of the CSRF-to-Stored XSS flaw in the Roi Calculator plugin.

SC-23 Session Authenticity good match
prevent

Prevents CSRF exploitation by enforcing session authenticity mechanisms such as anti-CSRF tokens to validate malicious requests from unauthenticated attackers.

SI-10 Information Input Validation good match
prevent

Blocks stored XSS payloads by validating and sanitizing information inputs to the plugin before they are processed or stored.

References