CVE-2025-25104
Published: 07 February 2025
Summary
CVE-2025-25104 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-25104 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the WordPress plugin URL-Preview-Box (also referred to as good-url-preview-box by author mraliende). It affects all versions up to and including 1.20. The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), reflecting its network-based exploitability with low attack complexity, no required privileges, user interaction dependency, changed scope, and low impacts across confidentiality, integrity, and availability.
Attackers can exploit this remotely without authentication by luring authenticated users—typically site administrators—into visiting a malicious webpage that forges requests to the vulnerable plugin endpoint. Successful exploitation enables the storage of malicious payloads, escalating to stored XSS as noted in related advisories, allowing script execution in the context of other users viewing affected content.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/good-url-preview-box/vulnerability/wordpress-url-preview-box-plugin-1-20-csrf-to-stored-xss-vulnerability?_s_id=cve details the CSRF-to-stored-XSS issue in version 1.20 and provides guidance on mitigation, including plugin updates where available or other protective measures.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4034
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in mraliende URL-Preview-Box good-url-preview-box allows Cross Site Request Forgery.This issue affects URL-Preview-Box: from n/a through <= 1.20.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CSRF vulnerability in the public-facing WordPress plugin directly enables exploitation of public-facing applications (T1190) and facilitates arbitrary JavaScript execution via the resulting stored XSS (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CSRF by requiring mechanisms to protect the authenticity of communications sessions, such as anti-CSRF tokens, preventing forged requests to the vulnerable plugin endpoint.
Enforces validation of information inputs like CSRF tokens or origin headers, blocking unauthorized cross-site requests that exploit the plugin's lack of protection.
Requires timely identification, reporting, and correction of flaws, directly addressing this CSRF vulnerability through plugin patching or removal.