CVE-2025-23435

CVE-2025-23435 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the marcucci Password Protect Plugin for WordPress (password-protect-plugin-for-wordpress) that enables Stored XSS. The vulnerability affects all versions of the plugin from n/a through 0.8.1.0, as published on 2025-01-16.

Attackers with network access can exploit this vulnerability without privileges (PR:N) and with low attack complexity (AC:L), though it requires user interaction (UI:R). Exploitation changes the scope (S:C) and allows limited impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), yielding a CVSS v3.1 base score of 7.1. This enables unauthenticated attackers to trick authenticated users into performing unintended actions via CSRF, resulting in persistent XSS payloads stored on the site.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/password-protect-plugin-for-wordpress/vulnerability/wordpress-password-protect-plugin-for-wordpress-plugin-0-8-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve provides further details on the vulnerability.