CVE-2025-23827
Published: 16 January 2025
Description
Adversaries may abuse various implementations of JavaScript for execution.
Security Summary
CVE-2025-23827 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Stored Cross-site Scripting (XSS) under CWE-79, affecting the Strx Magic Floating Sidebar Maker WordPress plugin (strx-magic-floating-sidebar-maker). The issue impacts all versions up to and including 1.4.1, as published on 2025-01-16.
Unauthenticated attackers (PR:N) with network access (AV:N) can exploit this vulnerability, which has low attack complexity (AC:L) but requires user interaction (UI:R). Exploitation changes scope (S:C), enabling limited impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), for an overall CVSS v3.1 score of 7.1. The vulnerability manifests as CSRF leading to Stored XSS, allowing injected scripts to persist and execute in the browsers of site visitors.
The Patchstack advisory provides details on this CSRF-to-Stored XSS vulnerability in Strx Magic Floating Sidebar Maker plugin version 1.4.1, available at https://patchstack.com/database/Wordpress/Plugin/strx-magic-floating-sidebar-maker/vulnerability/wordpress-strx-magic-floating-sidebar-maker-plugin-1-4-1-csrf-to-stored-xss-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Stored XSS in public-facing WordPress plugin directly enables exploitation of public-facing applications (T1190) and client-side JavaScript execution in visitor browsers (T1059.007).