Cyber Resilience

CVE-2025-25086

High

Published: 27 March 2025

Published
27 March 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0030 53.3th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-25086 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 46.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-25086 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the WPDeveloper Secret Meta (facebook-secret-meta) WordPress plugin that enables Reflected Cross-Site Scripting (XSS). Published on 2025-03-27, it affects all versions of the Secret Meta plugin through 1.2.1.

The vulnerability has a CVSS v3.1 base score of 7.1 (High), with network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), user interaction required (UI:R), and changed scope (S:C), resulting in low impacts to confidentiality, integrity, and availability (C:L/I:L/A:L). Attackers can exploit it by tricking authenticated users into performing unintended actions via malicious external sites, leading to reflected XSS execution in the victim's browser context.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/facebook-secret-meta/vulnerability/wordpress-secret-meta-plugin-1-2-1-csrf-to-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.

EU & UK References

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in WPDeveloper Secret Meta facebook-secret-meta allows Reflected XSS.This issue affects Secret Meta: from n/a through <= 1.2.1.

CWE(s)
CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1204.001 Malicious Link Execution
An adversary may rely upon a user clicking a malicious link in order to gain execution.
attack.mitre.org →
Why these techniques?

CSRF to reflected XSS in public-facing WordPress plugin directly enables exploitation of the web application (T1190) and is triggered via malicious links requiring user interaction (T1204.001).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-25121Shared CWE-352
CVE-2025-24001Shared CWE-352
CVE-2025-25147Shared CWE-352
CVE-2026-34904Shared CWE-352
CVE-2024-26153Shared CWE-352
CVE-2025-28860Shared CWE-352
CVE-2026-45430Shared CWE-352
CVE-2025-23880Shared CWE-352
CVE-2025-59541Shared CWE-352
CVE-2026-23622Shared CWE-352

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SC-23 Session Authenticity good match
prevent

SC-23 enforces session authenticity mechanisms like anti-CSRF tokens, directly preventing forged requests that exploit CVE-2025-25086 to trigger reflected XSS.

SI-2 Flaw Remediation good match
prevent

SI-2 requires timely flaw remediation, directly mitigating CVE-2025-25086 by patching the vulnerable WordPress plugin to version beyond 1.2.1.

SI-15 Information Output Filtering partial match
prevent

SI-15 mandates information output filtering and encoding, preventing reflected XSS execution resulting from the CSRF exploitation in CVE-2025-25086.

References