CVE-2025-31583
Published: 31 March 2025
Summary
CVE-2025-31583 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-31583 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP Copy Media URL WordPress plugin by Ashish Ajani that enables Stored XSS. The issue affects the plugin from unknown initial versions through version 2.1 inclusive.
Attackers require no privileges and can exploit this over the network with low attack complexity, though user interaction is needed. Exploitation changes the scope and results in low impacts to confidentiality, integrity, and availability, yielding a CVSS v3.1 base score of 7.1.
The Patchstack advisory provides further details on this vulnerability in the WP Copy Media URL plugin version 2.1 at https://patchstack.com/database/Wordpress/Plugin/wp-copy-media-url/vulnerability/wordpress-wp-copy-media-url-plugin-2-1-csrf-to-stored-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8792
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in Ashish Ajani WP Copy Media URL wp-copy-media-url allows Stored XSS.This issue affects WP Copy Media URL: from n/a through <= 2.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a CSRF-to-stored-XSS vulnerability in a public-facing WordPress plugin, directly enabling exploitation of public-facing applications for initial access or malicious script injection.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 mandates session authenticity mechanisms such as CSRF tokens, directly preventing the exploitation of the CSRF vulnerability in the WP Copy Media URL plugin.
SI-10 requires validation of all information inputs, blocking malicious XSS payloads from being stored via the CSRF attack vector.
SI-15 enforces output filtering to neutralize stored XSS scripts injected through the plugin's CSRF vulnerability before they execute in users' browsers.