CVE-2025-23445

CVE-2025-23445 is a Cross-Site Request Forgery (CSRF) vulnerability, corresponding to CWE-352, in the Easy Tynt WordPress plugin (easy-tynt) developed by scottswezey. The issue affects all versions from n/a through 0.2.5.1. Published on 2025-01-16, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to network accessibility, low complexity, and changed scope.

Attackers without privileges can exploit this over the network by tricking authenticated users into interacting with maliciously crafted web pages or links that submit forged requests to the vulnerable plugin. Successful exploitation enables unauthorized actions on behalf of the victim, potentially leading to low-level impacts on confidentiality, integrity, and availability.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/easy-tynt/vulnerability/wordpress-easy-tynt-plugin-0-2-5-1-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve provides details on the vulnerability, framing it as a CSRF issue enabling stored cross-site scripting (XSS). Security practitioners should consult this for patch availability and mitigation guidance, such as updating to a fixed version if released or implementing CSRF protections.