CVE-2025-23483

CVE-2025-23483 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Universal Analytics Injector WordPress plugin developed by hoyce. This flaw allows for Stored XSS and affects all versions of the plugin from its initial release through 1.0.3. The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility and scope change.

An unauthenticated attacker can exploit this vulnerability remotely with low attack complexity, requiring only user interaction such as tricking a site administrator into performing a malicious action, like visiting a crafted webpage. Successful exploitation enables the injection of stored XSS payloads via CSRF, potentially allowing attackers to steal sensitive data, impersonate users, or execute arbitrary scripts in the context of the affected site, with low impacts to confidentiality, integrity, and availability but elevated risk due to the changed scope.

The Patchstack advisory provides details on this WordPress plugin vulnerability, including recommendations for mitigation such as updating to a patched version if available or removing the plugin. Security practitioners should consult https://patchstack.com/database/Wordpress/Plugin/universal-analytics-injector/vulnerability/wordpress-universal-analytics-injector-plugin-1-0-3-csrf-to-stored-xss-vulnerability?_s_id=cve for specific remediation steps.