Cyber Posture

CVE-2025-23822

High

Published: 16 January 2025

Published
16 January 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0008 23.0th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse various implementations of JavaScript for execution.

Security Summary

CVE-2025-23822 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the WordPress plugin Category Custom Fields (categorycustomfields) developed by alicornea. This issue affects all versions from n/a through 1.0 inclusive. The vulnerability has a CVSS v3.1 base score of 7.1, with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating network accessibility, low attack complexity, no required privileges, user interaction needed, changed scope, and low impacts across confidentiality, integrity, and availability.

An unauthenticated attacker can exploit this CSRF vulnerability over the network by tricking an authenticated user into submitting a malicious request, such as through a crafted webpage or link that the user interacts with. Exploitation requires user interaction but no special privileges, enabling the attacker to perform unauthorized actions on behalf of the victim within the plugin's functionality, potentially leading to low-level impacts on confidentiality, integrity, and availability due to the changed scope.

The Patchstack advisory provides further details on this vulnerability, including mitigation recommendations, at https://patchstack.com/database/Wordpress/Plugin/categorycustomfields/vulnerability/wordpress-category-custom-fields-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve.

Details

CWE(s)
CWE-352

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
Why these techniques?

The CSRF vulnerability in the public-facing WordPress plugin directly enables exploitation of the application (T1190); the stored XSS component facilitates injection and execution of arbitrary JavaScript in victim browsers (T1059.007).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

References