CVE-2025-23618

Summary

CVE-2025-23618 is a newly disclosed vulnerability that combines Cross-Site Request Forgery (CSRF) and Stored XSS attacks. Affecting Twitter's Shortcode versions from n/a to 0.9, an attacker can exploit this issue to execute malicious scripts on users' browsers. The CSRF vulnerability allows unauthorized requests to be sent on behalf of a user, while the Stored XSS component enables the injection and execution of malicious scripts. This flaw poses a significant risk, enabling potential data theft, session hijacking, and other malicious activities. Users are urged to update to the latest version of Twitter Shortcode to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.