CVE-2025-31435
Published: 28 March 2025
Summary
CVE-2025-31435 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-31435 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Efficient Scripts Microblog Poster (microblog-poster) WordPress plugin that enables Stored Cross-Site Scripting (XSS). The vulnerability affects all versions of the plugin from its initial release through version 2.1.6 inclusive. It was published on 2025-03-28 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Attackers can exploit this vulnerability remotely over the network without requiring authentication privileges. Exploitation relies on user interaction, typically by tricking a legitimate user—such as an authenticated WordPress administrator—into visiting a malicious webpage that submits a forged request to the vulnerable plugin endpoint. Successful exploitation results in stored XSS, allowing attackers to inject and persist malicious scripts on the site, leading to low impacts on confidentiality, integrity, and availability within a changed scope.
The Patchstack advisory provides further details on this WordPress plugin vulnerability, including assessment and potential mitigation steps, accessible at https://patchstack.com/database/Wordpress/Plugin/microblog-poster/vulnerability/wordpress-microblog-poster-plugin-2-1-6-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8612
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in Efficient Scripts Microblog Poster microblog-poster allows Stored XSS.This issue affects Microblog Poster: from n/a through <= 2.1.6.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a remote CSRF vulnerability in a public-facing WordPress plugin that leads to stored XSS, directly enabling exploitation of an Internet-facing application without authentication.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CSRF vulnerability by enforcing session authenticity through unpredictable tokens or equivalent mechanisms, preventing forged requests from tricking authenticated users.
Validates and sanitizes inputs to the vulnerable plugin endpoint, blocking malicious payloads that lead to stored XSS.
Filters information outputs to prevent execution of any stored XSS scripts injected via the CSRF exploit when pages are rendered.