CVE-2025-24555
Published: 24 January 2025
Description
Adversaries may abuse various implementations of JavaScript for execution.
Security Summary
CVE-2025-24555 is a Cross-Site Request Forgery (CSRF) vulnerability in the Subscription DNA WordPress plugin (subscriptiondna) that allows Stored XSS. This issue affects Subscription DNA versions from n/a through <= 2.1. Published on 2025-01-24, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and maps to CWE-352.
The vulnerability can be exploited by unauthenticated attackers (PR:N) over the network (AV:N) with low complexity (AC:L), requiring user interaction (UI:R). Exploitation involves tricking a victim into performing a state-changing action via a forged request, enabling the storage of an XSS payload. Successful attacks result in low impacts to confidentiality, integrity, and availability (C:L/I:L/A:L) but with changed scope (S:C).
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/subscriptiondna/vulnerability/wordpress-subscription-dna-plugin-2-1-csrf-to-stored-xss-vulnerability?_s_id=cve documents this CSRF to Stored XSS vulnerability in the WordPress Subscription DNA plugin version 2.1.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Vulnerability in public-facing WordPress plugin enables exploitation of web app (T1190); stored XSS directly facilitates arbitrary JavaScript execution in browser context (T1059.007).