CVE-2025-24756
Published: 24 January 2025
Summary
CVE-2025-24756 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates this CVE by requiring timely identification, reporting, and remediation of the CSRF-to-Stored XSS flaw in the Roi Calculator plugin.
Prevents CSRF exploitation by enforcing session authenticity mechanisms such as anti-CSRF tokens to validate malicious requests from unauthenticated attackers.
Blocks stored XSS payloads by validating and sanitizing information inputs to the plugin before they are processed or stored.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF-to-Stored XSS in public-facing WordPress plugin directly enables T1190 (Exploit Public-Facing Application); exploitation requires tricking authenticated users via crafted link/webpage, mapping to T1204.001 (Malicious Link).
NVD Description
Cross-Site Request Forgery (CSRF) vulnerability in mgplugin Roi Calculator roi-calculator allows Stored XSS.This issue affects Roi Calculator: from n/a through <= 1.0.
Deeper analysisAI
CVE-2025-24756 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Roi Calculator (roi-calculator) from mgplugin that enables Stored XSS. The issue affects all versions of the plugin from unknown initial release through 1.0 inclusive. It is rated 7.1 High severity under CVSS 3.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and maps to CWE-352.
Unauthenticated attackers can exploit this vulnerability remotely with low complexity by tricking authenticated users into performing actions via a malicious request, such as through a crafted webpage or link that requires user interaction. Successful exploitation leads to Stored XSS, allowing attackers to inject and persist malicious scripts that execute in the context of other users viewing affected pages, with cross-origin scope change and low impacts to confidentiality, integrity, and availability.
The Patchstack advisory provides further details on the vulnerability, including analysis of the CSRF-to-Stored XSS chain in Roi Calculator version 1.0: https://patchstack.com/database/Wordpress/Plugin/roi-calculator/vulnerability/wordpress-roi-calculator-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve.
Details
- CWE(s)