CVE-2025-25138
Published: 07 February 2025
Summary
CVE-2025-25138 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces session authenticity mechanisms like anti-CSRF tokens to prevent forged requests from tricking authenticated users into storing XSS payloads via the vulnerable WordPress plugin endpoint.
Validates and sanitizes user inputs to the plugin to block malicious XSS scripts from being stored even if a CSRF request succeeds.
Provides timely flaw remediation by patching the specific CSRF to Stored XSS vulnerability in the ops-robots-txt plugin up to version 2.0.0.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF to Stored XSS in public-facing WordPress plugin directly enables T1190 exploitation and facilitates arbitrary JavaScript execution via T1059.007.
NVD Description
Cross-Site Request Forgery (CSRF) vulnerability in Rishi On Page SEO + Whatsapp Chat Button ops-robots-txt allows Stored XSS.This issue affects On Page SEO + Whatsapp Chat Button: from n/a through <= 2.0.0.
Deeper analysisAI
CVE-2025-25138 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the WordPress plugin Rishi On Page SEO + Whatsapp Chat Button (ops-robots-txt) that enables Stored XSS. The vulnerability affects all versions of the plugin from n/a through 2.0.0. It was published on 2025-02-07 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
A remote attacker requires no privileges and can exploit the vulnerability over the network with low complexity by tricking an authenticated user into performing an unintended action via a forged request, which requires user interaction. Successful exploitation leads to Stored XSS, allowing the attacker to achieve low impacts on confidentiality, integrity, and availability within a changed scope.
The Patchstack advisory provides further details on the vulnerability, including mitigation guidance, at https://patchstack.com/database/Wordpress/Plugin/ops-robots-txt/vulnerability/wordpress-on-page-seo-social-live-chat-formerly-ops-plugin-2-0-0-csrf-to-stored-xss-vulnerability?_s_id=cve.
Details
- CWE(s)