Cyber Posture

CVE-2025-23743

High

Published: 16 January 2025

Published
16 January 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0015 35.3th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse various implementations of JavaScript for execution.

Security Summary

CVE-2025-23743 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Social Analytics WordPress plugin developed by MartijnScheijbeler. This flaw allows for Stored Cross-Site Scripting (XSS) and affects all versions of the plugin from its initial release through 0.2 inclusive. The vulnerability received a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility and scope change.

Attackers can exploit this vulnerability remotely with low complexity and no required privileges, though it necessitates user interaction, such as luring an authenticated WordPress user to a malicious site. By crafting a CSRF payload, an attacker can trick the victim into submitting a request that injects a stored XSS payload into the plugin, which then executes in the context of the site for other users, potentially leading to low-level impacts on confidentiality, integrity, and availability.

The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/social-analytics/vulnerability/wordpress-social-analytics-plugin-0-2-csrf-to-stored-xss-vulnerability?_s_id=cve) documents this issue in the Social Analytics plugin version 0.2 and provides further technical details for practitioners.

Details

CWE(s)
CWE-352

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
Why these techniques?

The CSRF vulnerability in the public-facing WordPress plugin enables remote exploitation of a web application (T1190) and facilitates injection of JavaScript code via stored XSS for execution in the context of other users' browsers (T1059.007).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References