CVE-2025-23982
Published: 27 January 2025
Description
Adversaries may abuse various implementations of JavaScript for execution.
Security Summary
CVE-2025-23982 is a Missing Authorization vulnerability (CWE-862) in the Fare Calculator WordPress plugin developed by Gopi Krishnan, which enables Stored XSS. The vulnerability affects the fare-calculator plugin in all versions up to and including 1.1.
Unauthenticated attackers can exploit this issue remotely with low attack complexity and no required privileges, though user interaction is necessary. Exploitation typically involves CSRF to inject a malicious payload without authorization, resulting in stored XSS that executes in the context of other users viewing affected content. This can lead to low impacts on confidentiality, integrity, and availability, with a changed scope, as reflected in the CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
The Patchstack advisory provides details on this CSRF-to-Stored XSS vulnerability in Fare Calculator version 1.1, including recommended mitigations: https://patchstack.com/database/Wordpress/Plugin/fare-calculator/vulnerability/wordpress-fare-calculator-plugin-1-1-csrf-to-stored-cross-site-scripting-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The missing authorization vuln in the public-facing WordPress plugin directly enables exploitation of the application (T1190) to inject a stored XSS payload, which facilitates arbitrary JavaScript execution in victim browsers (T1059.007).