CVE-2025-25088
Published: 07 February 2025
Summary
CVE-2025-25088 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious Link (T1204.001); ranked at the 19.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-25088 is a Cross-Site Request Forgery (CSRF) vulnerability, corresponding to CWE-352, in the blackus3r WP Keyword Monitor WordPress plugin (wp-keyword-monitor). The issue affects all versions from n/a through 1.0.5 and was published on 2025-02-07. It carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, user interaction, changed scope, and low impacts to confidentiality, integrity, and availability.
An unauthenticated attacker can exploit this CSRF vulnerability over the network by tricking an authenticated user, such as a site administrator, into submitting a malicious request through a forged webpage or link. This could enable the attacker to perform unauthorized actions on behalf of the victim within the plugin's context.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp-keyword-monitor/vulnerability/wordpress-wp-keyword-monitor-plugin-1-0-5-csrf-to-stored-xss-vulnerability?_s_id=cve describes the flaw as a CSRF-to-stored-XSS vulnerability in WP Keyword Monitor version 1.0.5.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4024
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in blackus3r WP Keyword Monitor wp-keyword-monitor allows Cross Site Request Forgery.This issue affects WP Keyword Monitor: from n/a through <= 1.0.5.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF vulnerability enables attacker to inject stored XSS payload via malicious link (T1204.001) tricking authenticated user, which then facilitates arbitrary JavaScript execution in browser context (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 enforces session authenticity mechanisms like anti-CSRF tokens, directly preventing forged requests that exploit this CSRF vulnerability.
SI-10 requires validation of information inputs, including CSRF tokens and payloads, blocking malicious requests and stored XSS injections enabled by this vulnerability.
SI-15 filters information outputs to prevent execution of stored XSS payloads that can result from successful CSRF exploitation in this vulnerability.