CVE-2025-31440
Published: 28 March 2025
Summary
CVE-2025-31440 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-31440 is a Cross-Site Request Forgery (CSRF) vulnerability in the Strategy11 Team Terms of Use WordPress plugin (terms-of-use-2) that allows Stored Cross-Site Scripting (XSS). This issue affects the plugin from unknown initial versions through version 2.0 inclusive.
Unauthenticated attackers can exploit the vulnerability over the network with low attack complexity by tricking users into submitting malicious requests, requiring user interaction. Exploitation via CSRF enables the storage of XSS payloads, potentially leading to low impacts on confidentiality, integrity, and availability with a changed scope, as reflected in the CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and associated CWE-352.
The Patchstack advisory provides further details on this WordPress plugin vulnerability, including potential mitigation steps, accessible at https://patchstack.com/database/Wordpress/Plugin/terms-of-use-2/vulnerability/wordpress-terms-of-use-plugin-2-0-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8607
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in Strategy11 Team Terms of Use terms-of-use-2 allows Stored XSS.This issue affects Terms of Use: from n/a through <= 2.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF to stored XSS in public-facing WordPress plugin directly enables exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 enforces validation of all information inputs, directly preventing the acceptance and storage of malicious XSS payloads submitted via CSRF in the Terms of Use plugin.
SC-23 requires session authenticity mechanisms such as CSRF tokens, blocking unauthorized forged requests that exploit the plugin to store XSS payloads.
SI-15 mandates filtering of information prior to output on web pages, neutralizing any stored XSS payloads from the vulnerable plugin before execution.