Cyber Posture

CVE-2025-23982

High

Published: 27 January 2025

Published
27 January 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0009 25.1th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse various implementations of JavaScript for execution.

Security Summary

CVE-2025-23982 is a Missing Authorization vulnerability (CWE-862) in the Fare Calculator WordPress plugin developed by Gopi Krishnan, which enables Stored XSS. The vulnerability affects the fare-calculator plugin in all versions up to and including 1.1.

Unauthenticated attackers can exploit this issue remotely with low attack complexity and no required privileges, though user interaction is necessary. Exploitation typically involves CSRF to inject a malicious payload without authorization, resulting in stored XSS that executes in the context of other users viewing affected content. This can lead to low impacts on confidentiality, integrity, and availability, with a changed scope, as reflected in the CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

The Patchstack advisory provides details on this CSRF-to-Stored XSS vulnerability in Fare Calculator version 1.1, including recommended mitigations: https://patchstack.com/database/Wordpress/Plugin/fare-calculator/vulnerability/wordpress-fare-calculator-plugin-1-1-csrf-to-stored-cross-site-scripting-vulnerability?_s_id=cve.

Details

CWE(s)
CWE-862

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
Why these techniques?

The missing authorization vuln in the public-facing WordPress plugin directly enables exploitation of the application (T1190) to inject a stored XSS payload, which facilitates arbitrary JavaScript execution in victim browsers (T1059.007).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References