CVE-2025-25074
Published: 07 February 2025
Summary
CVE-2025-25074 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-25074 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP Social Stream WordPress plugin by Nirmal Kumar Ram, which allows Stored XSS. The issue affects WP Social Stream versions from n/a through 1.1 inclusive.
Attackers with network access can exploit this vulnerability without privileges, though it requires user interaction and has low attack complexity. Exploitation changes the security scope, enabling low impacts on confidentiality, integrity, and availability, as reflected in its CVSS score of 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Unauthenticated attackers can trick users into submitting CSRF requests that store XSS payloads on the site.
The Patchstack advisory provides further details on this vulnerability, available at https://patchstack.com/database/Wordpress/Plugin/wp-social-stream/vulnerability/wordpress-wp-social-stream-plugin-1-1-csrf-to-stored-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4014
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in Nirmal Kumar Ram WP Social Stream wp-social-stream allows Stored XSS.This issue affects WP Social Stream: from n/a through <= 1.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF to stored XSS in public-facing WordPress plugin directly enables T1190 (exploiting public-facing app) and T1059.007 (arbitrary JavaScript execution via XSS payload).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 enforces session authenticity mechanisms like CSRF tokens, directly preventing unauthenticated attackers from forging requests to store XSS payloads.
SI-10 validates all information inputs to block malicious XSS payloads from being accepted and stored via CSRF exploitation.
SI-15 filters information outputs to neutralize any stored XSS payloads that might have been injected through the CSRF vulnerability.