CVE-2025-31623
Published: 31 March 2025
Summary
CVE-2025-31623 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 49.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-31623 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the richtexteditor Rich Text Editor WordPress plugin that enables Stored XSS. Published on 2025-03-31, it affects all versions of the plugin from n/a through 1.0.1, carrying a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Unauthenticated attackers can exploit this vulnerability remotely with low complexity, requiring only user interaction such as tricking a victim into visiting a malicious page or clicking a forged link. Exploitation via CSRF allows injection of Stored XSS payloads, achieving low impacts on confidentiality, integrity, and availability while changing scope to impact other users or components viewing the tainted content.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/richtexteditor/vulnerability/wordpress-rich-text-editor-plugin-1-0-1-csrf-to-stored-xss-vulnerability?_s_id=cve details the vulnerability in the WordPress Rich Text Editor plugin version 1.0.1 and provides associated mitigation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8774
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in richtexteditor Rich Text Editor richtexteditor allows Stored XSS.This issue affects Rich Text Editor: from n/a through <= 1.0.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a CSRF vulnerability in a public-facing WordPress plugin that directly enables Stored XSS injection, mapping to exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 enforces session authenticity through tokens or similar mechanisms, directly preventing CSRF attacks that trick users into injecting Stored XSS payloads.
SI-10 validates information inputs to reject malicious XSS payloads, stopping their storage via the CSRF vector in the Rich Text Editor plugin.
SI-15 filters information outputs to sanitize rendered content, preventing execution of any Stored XSS payloads injected through the CSRF vulnerability.