Cyber Posture

CVE-2025-25126

High

Published: 07 February 2025

Published
07 February 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0007 21.3th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

An adversary may rely upon a user clicking a malicious link in order to gain execution.

Security Summary

CVE-2025-25126 is a Cross-Site Request Forgery (CSRF) vulnerability in the ZMSEO WordPress plugin that allows Stored Cross-Site Scripting (XSS). This issue, associated with CWE-352, affects the ZMSEO plugin from unknown initial versions through version 1.14.1 inclusive. The vulnerability received a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, user interaction, changed scope, and low impacts across confidentiality, integrity, and availability.

Unauthenticated attackers (PR:N) can exploit this vulnerability over the network (AV:N) by tricking authenticated users into interacting with a malicious webpage (UI:R), such as clicking a link or visiting a site that submits a forged CSRF request. This action enables the storage of XSS payloads within the plugin, potentially allowing subsequent execution in the context of other users viewing affected content.

The primary advisory from Patchstack details the CSRF-to-Stored XSS vulnerability in ZMSEO plugin version 1.14.1 and is available at https://patchstack.com/database/Wordpress/Plugin/zmseo/vulnerability/wordpress-zmseo-plugin-1-14-1-csrf-to-stored-xss-vulnerability?_s_id=cve for mitigation guidance and patch information.

Details

CWE(s)
CWE-352

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1204.001 Malicious Link Execution
An adversary may rely upon a user clicking a malicious link in order to gain execution.
Why these techniques?

CSRF-to-stored XSS in public-facing WordPress plugin directly enables T1190 (Exploit Public-Facing Application); exploitation requires tricking users via malicious link matching T1204.001 (Malicious Link).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References