Cyber Posture

CVE-2025-23745

High

Published: 16 January 2025

Published
16 January 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0015 35.3th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse various implementations of JavaScript for execution.

Security Summary

CVE-2025-23745 is a Cross-Site Request Forgery (CSRF) vulnerability in the Call me Now WordPress plugin by Tussendoor B.V., which enables Stored Cross-Site Scripting (XSS). The issue affects the plugin from unknown initial versions through 1.0.5 and is associated with CWE-352.

Attackers require no privileges and can exploit this over the network with low complexity, though user interaction is needed. Per the CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), exploitation changes scope and yields low impacts on confidentiality, integrity, and availability. Unauthenticated attackers can forge requests to trick users into injecting and storing XSS payloads, which then execute for subsequent visitors.

The Patchstack advisory provides further details on this WordPress plugin vulnerability, including assessment and recommended actions.

Details

CWE(s)
CWE-352

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
attack.mitre.org →
Why these techniques?

The CVE describes a vulnerability in a public-facing WordPress plugin exploitable over the network without authentication, directly mapping to T1190. The CSRF-enabled stored XSS allows injection of JavaScript payloads that execute in visitors' browsers, facilitating T1059.007.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

References