Cyber Posture

CVE-2025-23827

High

Published: 16 January 2025

Published
16 January 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0035 57.2th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse various implementations of JavaScript for execution.

Security Summary

CVE-2025-23827 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Stored Cross-site Scripting (XSS) under CWE-79, affecting the Strx Magic Floating Sidebar Maker WordPress plugin (strx-magic-floating-sidebar-maker). The issue impacts all versions up to and including 1.4.1, as published on 2025-01-16.

Unauthenticated attackers (PR:N) with network access (AV:N) can exploit this vulnerability, which has low attack complexity (AC:L) but requires user interaction (UI:R). Exploitation changes scope (S:C), enabling limited impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), for an overall CVSS v3.1 score of 7.1. The vulnerability manifests as CSRF leading to Stored XSS, allowing injected scripts to persist and execute in the browsers of site visitors.

The Patchstack advisory provides details on this CSRF-to-Stored XSS vulnerability in Strx Magic Floating Sidebar Maker plugin version 1.4.1, available at https://patchstack.com/database/Wordpress/Plugin/strx-magic-floating-sidebar-maker/vulnerability/wordpress-strx-magic-floating-sidebar-maker-plugin-1-4-1-csrf-to-stored-xss-vulnerability?_s_id=cve.

Details

CWE(s)
CWE-79

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
Why these techniques?

Stored XSS in public-facing WordPress plugin directly enables exploitation of public-facing applications (T1190) and client-side JavaScript execution in visitor browsers (T1059.007).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References