CVE-2025-25125
Published: 07 February 2025
Summary
CVE-2025-25125 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-25125 is a Cross-Site Request Forgery (CSRF) vulnerability in the fyrebox-shortcode component of the CyrilG Fyrebox Quizzes WordPress plugin. This issue enables Stored Cross-Site Scripting (XSS) and affects Fyrebox Quizzes versions from n/a through 3.1 inclusive. The vulnerability is associated with CWE-352 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility and scope change.
Unauthenticated attackers (PR:N) can exploit this vulnerability remotely (AV:N) with low complexity (AC:L), though it requires user interaction (UI:R), such as a victim visiting a malicious site. Exploitation involves tricking an authenticated user into submitting a forged request via CSRF, leading to stored XSS injection. This allows attackers to achieve low impacts on confidentiality, integrity, and availability (C:L/I:L/A:L) within a changed security scope (S:C), potentially executing scripts in the context of other users viewing affected quiz content.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/fyrebox-shortcode/vulnerability/wordpress-fyrebox-quizzes-plugin-2-7-csrf-to-stored-xss-vulnerability?_s_id=cve documents this as a CSRF-to-stored XSS issue specifically in Fyrebox Quizzes plugin version 2.7, consistent with the broader CVE impact up to 3.1. Security practitioners should consult the advisory for recommended mitigations, such as updating to a patched version of the plugin.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4044
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in CyrilG Fyrebox Quizzes fyrebox-shortcode allows Stored XSS.This issue affects Fyrebox Quizzes: from n/a through <= 3.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF-to-stored XSS in public-facing WordPress plugin directly enables exploitation of the application (T1190) and facilitates arbitrary JavaScript execution in victim browsers via injected scripts (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 enforces session authenticity mechanisms like CSRF tokens, directly preventing forged requests that exploit this vulnerability to inject stored XSS payloads.
SI-10 requires validation of all inputs to the fyrebox-shortcode component, blocking malicious XSS payloads from being stored via CSRF exploitation.
SI-15 mandates output filtering and encoding when rendering quiz content, preventing execution of any stored XSS payloads injected through the CSRF vulnerability.