CVE-2025-25126

High

Published: 07 February 2025

Published

07 February 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS Score 0.0007 21.7th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-25126 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 21.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-25126 is a Cross-Site Request Forgery (CSRF) vulnerability in the ZMSEO WordPress plugin that allows Stored Cross-Site Scripting (XSS). This issue, associated with CWE-352, affects the ZMSEO plugin from unknown initial versions through version 1.14.1 inclusive. The vulnerability received a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, user interaction, changed scope, and low impacts across confidentiality, integrity, and availability.

Unauthenticated attackers (PR:N) can exploit this vulnerability over the network (AV:N) by tricking authenticated users into interacting with a malicious webpage (UI:R), such as clicking a link or visiting a site that submits a forged CSRF request. This action enables the storage of XSS payloads within the plugin, potentially allowing subsequent execution in the context of other users viewing affected content.

The primary advisory from Patchstack details the CSRF-to-Stored XSS vulnerability in ZMSEO plugin version 1.14.1 and is available at https://patchstack.com/database/Wordpress/Plugin/zmseo/vulnerability/wordpress-zmseo-plugin-1-14-1-csrf-to-stored-xss-vulnerability?_s_id=cve for mitigation guidance and patch information.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-4045

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in zmseo ZMSEO zmseo allows Stored XSS.This issue affects ZMSEO: from n/a through <= 1.14.1.

CWE(s): CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1204.001 Malicious Link Execution

An adversary may rely upon a user clicking a malicious link in order to gain execution.

attack.mitre.org →

Why these techniques?

CSRF-to-stored XSS in public-facing WordPress plugin directly enables T1190 (Exploit Public-Facing Application); exploitation requires tricking users via malicious link matching T1204.001 (Malicious Link).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0