CVE-2025-23426

CVE-2025-23426 is a Cross-Site Request Forgery (CSRF) vulnerability in the go-social WordPress plugin by Binesh Dobhal that enables Stored Cross-Site Scripting (XSS). The issue affects the plugin from unknown initial versions through 1.0 inclusive, as documented under CWE-352.

Attackers with network access can exploit this vulnerability without authentication privileges, though it requires user interaction and has low attack complexity. Exploitation changes the scope (S:C) and results in low impacts to confidentiality, integrity, and availability, yielding a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). A malicious actor can craft a CSRF attack to trick an authenticated user into submitting a request that stores an XSS payload on the site.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/go-social/vulnerability/wordpress-go-social-plugin-1-0-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve provides details on this CSRF-to-Stored XSS vulnerability in go-social version 1.0.