CVE-2025-23808
Published: 16 January 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-23808 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Custom List Table Example by Dutch van Andel, affecting all versions from n/a through 1.4.1. The flaw enables Reflected Cross-Site Scripting (XSS) and is classified under CWE-352, with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
An unauthenticated attacker can exploit this over the network with low attack complexity, requiring user interaction such as visiting a malicious page. By tricking a logged-in user into submitting a forged request, the attacker triggers reflected XSS, achieving low impacts on confidentiality, integrity, and availability within a changed scope.
The Patchstack advisory documents the CSRF to Reflected XSS vulnerability in Custom List Table Example plugin version 1.4.1 and provides details for mitigation. Security practitioners should review this reference for recommended remediation steps.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The CVE describes a CSRF vulnerability in a public-facing WordPress plugin that enables reflected XSS, directly mapping to exploitation of a weakness in an Internet-facing application over the network.