CVE-2025-28923
Published: 11 March 2025
Summary
CVE-2025-28923 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-28923, published on 2025-03-11, is a Cross-Site Request Forgery (CSRF) vulnerability classified under CWE-352 in the WordPress plugin "No Disposable Email" developed by philippe. The flaw enables Stored XSS and affects all versions of the plugin from unknown initial release through 2.5.1. It carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), reflecting network-based exploitation with low complexity, no required privileges, user interaction, and scope change leading to low impacts across confidentiality, integrity, and availability.
Attackers can exploit this vulnerability without authentication by crafting a malicious webpage that tricks a logged-in user, typically a site administrator, into submitting a forged request to the plugin's endpoint via user interaction such as clicking a link or loading an image. Successful CSRF triggers Stored XSS, allowing attackers to inject and persist malicious scripts on the WordPress site, which execute in victims' browsers upon page access, potentially enabling session hijacking, data theft, or further attacks on site visitors.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/no-disposable-email/vulnerability/wordpress-no-disposable-email-plugin-2-5-1-csrf-to-stored-xss-vulnerability?_s_id=cve details the vulnerability in the No Disposable Email plugin version 2.5.1 and recommends mitigation through updating to a patched version beyond 2.5.1.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7874
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in philippe No Disposable Email no-disposable-email allows Stored XSS.This issue affects No Disposable Email: from n/a through <= 2.5.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CSRF vulnerability in a public-facing WordPress plugin directly enables exploitation of public-facing applications (T1190); the resulting Stored XSS facilitates browser session hijacking (T1185) as explicitly noted in the description.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly protects against CSRF attacks by ensuring the authenticity of communications sessions, preventing forged requests that trigger Stored XSS in the plugin.
Validates plugin inputs to block malicious payloads from being stored as XSS, mitigating the vulnerability even if CSRF occurs.
Requires timely remediation of flaws like this CVE by patching the No Disposable Email plugin to versions beyond 2.5.1.