CVE-2025-25075
Published: 07 February 2025
Summary
CVE-2025-25075 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-25075 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the WordPress plugin "Show notice or message on admin area" developed by Venugopal. This flaw enables Stored Cross-Site Scripting (XSS) and affects all versions of the plugin from n/a through 2.0 inclusive. The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, user interaction, changed scope, and low impacts across confidentiality, integrity, and availability.
Unauthenticated attackers (PR:N) can exploit this CSRF vulnerability by tricking authenticated administrators into performing actions via a malicious webpage that requires user interaction (UI:R), such as visiting a crafted link. This leads to the storage of XSS payloads in the admin area, allowing arbitrary JavaScript execution in the context of logged-in admins upon viewing affected notices or messages.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/show-notice-or-message-on-admin-area/vulnerability/wordpress-show-notice-or-message-on-admin-area-plugin-2-0-csrf-to-stored-xss-vulnerability?_s_id=cve) documents the vulnerability and associated risks in the plugin.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4015
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in Venugopal Show notice or message on admin area show-notice-or-message-on-admin-area allows Stored XSS.This issue affects Show notice or message on admin area: from n/a through <= 2.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The public-facing WordPress plugin vulnerability (CSRF to stored XSS) enables exploitation of a web application leading to arbitrary JavaScript execution in the admin browser context.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Information input validation directly prevents the storage of malicious XSS payloads submitted via the CSRF-vulnerable endpoint in the WordPress plugin.
Session authenticity mechanisms, such as anti-CSRF tokens, block forged requests from unauthenticated attackers tricking admins into storing XSS payloads.
Information output filtering sanitizes notices or messages when displayed in the admin area, preventing execution of any stored XSS payloads.