CVE-2025-25153
Published: 07 February 2025
Summary
CVE-2025-25153 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-25153 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the djjmz Simple Auto Tag WordPress plugin (simple-auto-tag). The issue affects all versions from n/a through 1.1 inclusive and enables Stored Cross-Site Scripting (XSS). Published on 2025-02-07, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, user interaction, changed scope, and low impacts across confidentiality, integrity, and availability.
Unauthenticated attackers can exploit this vulnerability remotely by crafting a malicious webpage or link that, when visited by an authenticated site administrator, triggers a CSRF request to the plugin's functionality. This results in the storage of an XSS payload on the site, which executes in the context of the WordPress administrator's browser and potentially other users viewing affected content. The changed scope amplifies the impact by allowing script execution across site contexts.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/simple-auto-tag/vulnerability/wordpress-simple-auto-tag-plugin-1-1-csrf-to-stored-xss-vulnerability?_s_id=cve) documents the CSRF-to-stored-XSS vulnerability specifically in Simple Auto Tag version 1.1 for WordPress.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4062
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in djjmz Simple Auto Tag simple-auto-tag allows Stored XSS.This issue affects Simple Auto Tag: from n/a through <= 1.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CSRF vulnerability in the public-facing WordPress plugin directly enables remote exploitation of the web application (T1190) and facilitates injection of persistent XSS payloads that execute JavaScript in the administrator's browser (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 requires session authenticity protections such as CSRF tokens, directly preventing unauthenticated attackers from forging requests to store XSS payloads via the Simple Auto Tag plugin.
SI-10 enforces validation of inputs to the plugin's auto-tag functionality, rejecting malicious payloads that could lead to stored XSS.
SI-15 implements output filtering and encoding to neutralize any stored XSS payloads when affected content is rendered for administrators or users.