CVE-2025-25149

High

Published: 07 February 2025

Published

07 February 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS Score 0.0011 28.9th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-25149 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-25149 is a Cross-Site Request Forgery (CSRF) vulnerability in the Danillo Nunes Login-box WordPress plugin that allows Stored Cross-Site Scripting (XSS). This issue affects all versions of the Login-box plugin from unknown initial versions through 2.0.4 inclusive.

A remote attacker with no required privileges can exploit this vulnerability by tricking a user into submitting a malicious request, such as via a crafted webpage, leading to the storage of an XSS payload. The CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) indicates network accessibility, low attack complexity, user interaction requirement, and changed scope, with low impacts on confidentiality, integrity, and availability.

Patchstack's advisory documents this CSRF to Stored XSS vulnerability specifically in the WordPress Login-box plugin up to version 2.0.4, providing details on the issue for affected installations.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-4059

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in Danillo Nunes Login-box login-box allows Stored XSS.This issue affects Login-box: from n/a through <= 2.0.4.

CWE(s): CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

CSRF to Stored XSS in public-facing WordPress plugin directly enables exploitation of a web application via network-accessible vector with user interaction.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0