CVE-2025-25160
Published: 07 February 2025
Summary
CVE-2025-25160 is a high-severity CSRF (CWE-352) vulnerability in Markbarnes Style Tweaker. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-25160 is a Cross-Site Request Forgery (CSRF) vulnerability in the Mark Barnes Style Tweaker WordPress plugin (style-tweaker) that enables Stored XSS. This issue affects the plugin from unknown initial versions through version 0.11 inclusive, as documented under CWE-352. The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, necessary user interaction, and changed scope with low impacts across confidentiality, integrity, and availability.
An attacker can exploit this vulnerability by crafting a malicious webpage or link that, when visited by an authenticated WordPress user with sufficient privileges (such as an administrator capable of style tweaks), triggers a CSRF request to the plugin's endpoint. This results in the storage of malicious XSS payloads within the site's styles, which then execute in the context of other users viewing affected pages. Exploitation requires user interaction but no prior authentication or privileges on the attacker's part, potentially allowing session hijacking, data theft, or further site compromise within the plugin's scope.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/style-tweaker/vulnerability/wordpress-style-tweaker-plugin-0-11-csrf-to-stored-xss-vulnerability?_s_id=cve. The vulnerability was published on 2025-02-07.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4067
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in Mark Barnes Style Tweaker style-tweaker allows Stored XSS.This issue affects Style Tweaker: from n/a through <= 0.11.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CSRF-to-stored-XSS vulnerability in a public-facing WordPress plugin directly enables exploitation of public-facing applications (T1190) and facilitates arbitrary JavaScript execution via injected XSS payloads in user browsers (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 enforces session authenticity mechanisms like anti-CSRF tokens to prevent forged requests that store malicious XSS payloads in the Style Tweaker plugin.
SI-10 validates inputs to the plugin endpoint to block acceptance and storage of XSS payloads delivered via CSRF.
SI-15 filters output to neutralize execution of any XSS payloads stored through the CSRF vulnerability when pages are viewed.