Cyber Resilience

CVE-2025-25100

High

Published: 27 March 2025

Published
27 March 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0030 53.3th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-25100 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 46.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-25100 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Cazamba WordPress plugin developed by victoracano. The flaw enables Reflected Cross-Site Scripting (XSS) and affects all versions of Cazamba from n/a through 1.2 inclusive. It carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to network accessibility, low attack complexity, no required privileges, user interaction, and changed scope with low impacts on confidentiality, integrity, and availability.

Remote attackers without authentication can exploit this vulnerability by tricking users into interacting with a maliciously crafted request, such as via a link on a website or in an email. This leads to reflected XSS execution in the victim's browser context, potentially allowing limited theft of sensitive data or manipulation within the plugin's scope.

The Patchstack advisory provides further details on this WordPress plugin vulnerability, including recommended mitigations, accessible at https://patchstack.com/database/Wordpress/Plugin/cazamba/vulnerability/wordpress-cazamba-plugin-1-2-csrf-to-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.

EU & UK References

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in victoracano Cazamba cazamba allows Reflected XSS.This issue affects Cazamba: from n/a through <= 1.2.

CWE(s)
CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1204.001 Malicious Link Execution
An adversary may rely upon a user clicking a malicious link in order to gain execution.
attack.mitre.org →
Why these techniques?

CSRF to reflected XSS in public-facing WordPress plugin directly enables exploitation of public-facing apps (T1190) via malicious links requiring user interaction (T1204.001).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-25121Shared CWE-352
CVE-2025-24001Shared CWE-352
CVE-2025-25147Shared CWE-352
CVE-2026-34904Shared CWE-352
CVE-2024-26153Shared CWE-352
CVE-2025-28860Shared CWE-352
CVE-2026-45430Shared CWE-352
CVE-2025-23880Shared CWE-352
CVE-2025-59541Shared CWE-352
CVE-2026-23622Shared CWE-352

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SC-23 Session Authenticity good match
prevent

Directly mitigates CSRF by protecting communications session authenticity, explicitly including protection against cross-site request forgery attacks.

SI-10 Information Input Validation good match
prevent

Validates untrusted inputs to prevent reflected XSS payloads from being processed in the Cazamba plugin.

SI-15 Information Output Filtering good match
prevent

Filters information outputs to block execution of malicious scripts resulting from the CSRF-enabled reflected XSS.

References