CVE-2025-25086
Published: 27 March 2025
Description
An adversary may rely upon a user clicking a malicious link in order to gain execution.
Security Summary
CVE-2025-25086 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the WPDeveloper Secret Meta (facebook-secret-meta) WordPress plugin that enables Reflected Cross-Site Scripting (XSS). Published on 2025-03-27, it affects all versions of the Secret Meta plugin through 1.2.1.
The vulnerability has a CVSS v3.1 base score of 7.1 (High), with network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), user interaction required (UI:R), and changed scope (S:C), resulting in low impacts to confidentiality, integrity, and availability (C:L/I:L/A:L). Attackers can exploit it by tricking authenticated users into performing unintended actions via malicious external sites, leading to reflected XSS execution in the victim's browser context.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/facebook-secret-meta/vulnerability/wordpress-secret-meta-plugin-1-2-1-csrf-to-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
CSRF to reflected XSS in public-facing WordPress plugin directly enables exploitation of the web application (T1190) and is triggered via malicious links requiring user interaction (T1204.001).