CVE-2025-23822
Published: 16 January 2025
Description
Adversaries may abuse various implementations of JavaScript for execution.
Security Summary
CVE-2025-23822 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the WordPress plugin Category Custom Fields (categorycustomfields) developed by alicornea. This issue affects all versions from n/a through 1.0 inclusive. The vulnerability has a CVSS v3.1 base score of 7.1, with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating network accessibility, low attack complexity, no required privileges, user interaction needed, changed scope, and low impacts across confidentiality, integrity, and availability.
An unauthenticated attacker can exploit this CSRF vulnerability over the network by tricking an authenticated user into submitting a malicious request, such as through a crafted webpage or link that the user interacts with. Exploitation requires user interaction but no special privileges, enabling the attacker to perform unauthorized actions on behalf of the victim within the plugin's functionality, potentially leading to low-level impacts on confidentiality, integrity, and availability due to the changed scope.
The Patchstack advisory provides further details on this vulnerability, including mitigation recommendations, at https://patchstack.com/database/Wordpress/Plugin/categorycustomfields/vulnerability/wordpress-category-custom-fields-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The CSRF vulnerability in the public-facing WordPress plugin directly enables exploitation of the application (T1190); the stored XSS component facilitates injection and execution of arbitrary JavaScript in victim browsers (T1059.007).