CVE-2025-23467

CVE-2025-23467 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the RSS News Scroller WordPress plugin developed by vimal.ghorecha. This flaw allows for Stored XSS and affects all versions of the plugin from an unspecified initial release through 2.0.0. The vulnerability was published on 2025-01-16 and carries a CVSS v3.1 base score of 7.1 (High), with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L.

The vulnerability can be exploited by unauthenticated attackers accessible over the network, requiring low complexity and user interaction, such as tricking a site administrator into visiting a malicious site or clicking a crafted link. This CSRF condition enables the attacker to forge requests that inject malicious payloads, resulting in stored XSS. Exploitation achieves low impacts across confidentiality, integrity, and availability, with a changed scope allowing cross-origin script execution that persists and affects other users viewing the RSS scroller content.

Mitigation details are available in advisories such as the Patchstack database entry at https://patchstack.com/database/Wordpress/Plugin/rss-news-scroller/vulnerability/wordpress-rss-news-scroller-plugin-2-0-0-csrf-to-stored-xss-vulnerability?_s_id=cve.