CVE-2025-23511
Published: 16 January 2025
Description
Cross-Site Request Forgery (CSRF) vulnerability in Stargazer WP-BlackCheck wp-blackcheck allows Stored XSS.This issue affects WP-BlackCheck: from n/a through <= 2.7.2.
Security Summary
CVE-2025-23511 is a Cross-Site Request Forgery (CSRF) vulnerability in the Stargazer WP-BlackCheck WordPress plugin (wp-blackcheck) that enables Stored Cross-Site Scripting (XSS). This issue affects all versions of WP-BlackCheck from n/a through 2.7.2, as documented under CWE-352.
Unauthenticated attackers (PR:N) can exploit the vulnerability over the network (AV:N) with low attack complexity (AC:L), requiring user interaction (UI:R) such as tricking an administrator into visiting a malicious site or clicking a crafted link. Exploitation changes the scope (S:C) and allows storage of malicious scripts via CSRF, resulting in low impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), for an overall CVSS v3.1 base score of 7.1.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp-blackcheck/vulnerability/wordpress-wp-blackcheck-plugin-2-7-2-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve details the vulnerability in the WP-BlackCheck plugin version 2.7.2.
Details
- CWE(s)