CVE-2025-23869
Published: 16 January 2025
Description
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Security Summary
CVE-2025-23869 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the CJ Custom Content WordPress plugin (cj-custom-content) developed by shibulijack. This flaw enables Stored Cross-Site Scripting (XSS) and affects all versions from unknown initial release through 2.0 inclusive. The vulnerability received a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility, low complexity, lack of required privileges, and scope change despite requiring user interaction.
Unauthenticated attackers can exploit this vulnerability by crafting a malicious webpage that, when visited by a legitimate user (such as an administrator), triggers a CSRF request to the vulnerable plugin endpoint. This stores a malicious XSS payload persistently within the site's content. Once stored, the payload executes in the context of other users' browsers, potentially leading to session hijacking, data theft, or further site compromise, with low impacts on confidentiality, integrity, and availability.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/cj-custom-content/vulnerability/wordpress-cj-custom-content-plugin-2-0-csrf-to-cross-site-scripting-vulnerability?_s_id=cve) documents this CSRF-to-XSS issue in the CJ Custom Content plugin version 2.0 for WordPress.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The CSRF-to-stored-XSS vulnerability in a public-facing WordPress plugin directly enables exploitation of public-facing applications (T1190) and facilitates browser session hijacking (T1185) via persistent malicious JavaScript execution in user browsers.