CVE-2025-25153
Published: 07 February 2025
Description
Adversaries may abuse various implementations of JavaScript for execution.
Security Summary
CVE-2025-25153 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the djjmz Simple Auto Tag WordPress plugin (simple-auto-tag). The issue affects all versions from n/a through 1.1 inclusive and enables Stored Cross-Site Scripting (XSS). Published on 2025-02-07, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, user interaction, changed scope, and low impacts across confidentiality, integrity, and availability.
Unauthenticated attackers can exploit this vulnerability remotely by crafting a malicious webpage or link that, when visited by an authenticated site administrator, triggers a CSRF request to the plugin's functionality. This results in the storage of an XSS payload on the site, which executes in the context of the WordPress administrator's browser and potentially other users viewing affected content. The changed scope amplifies the impact by allowing script execution across site contexts.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/simple-auto-tag/vulnerability/wordpress-simple-auto-tag-plugin-1-1-csrf-to-stored-xss-vulnerability?_s_id=cve) documents the CSRF-to-stored-XSS vulnerability specifically in Simple Auto Tag version 1.1 for WordPress.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The CSRF vulnerability in the public-facing WordPress plugin directly enables remote exploitation of the web application (T1190) and facilitates injection of persistent XSS payloads that execute JavaScript in the administrator's browser (T1059.007).