CVE-2025-23559

CVE-2025-23559 is a Cross-Site Request Forgery (CSRF) vulnerability in the MemeOne WordPress plugin developed by Stepan Stepasyuk, which allows Stored XSS. This issue affects MemeOne from its initial release (n/a) through version 2.0.5. Published on 2025-01-16T20:15:39.650, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and is associated with CWE-352.

The vulnerability can be exploited remotely by unauthenticated attackers (PR:N) over the network (AV:N) with low complexity (AC:L), though it requires user interaction (UI:R), such as a victim visiting a malicious site. Successful exploitation via CSRF enables attackers to store XSS payloads on the affected WordPress site, potentially compromising confidentiality, integrity, and availability with changed scope (S:C).

Patchstack's advisory at https://patchstack.com/database/wordpress/plugin/memeone/vulnerability/wordpress-memeone-plugin-2-0-5-csrf-to-stored-xss-vulnerability?_s_id=cve details the CSRF-to-Stored XSS issue in MemeOne plugin version 2.0.5 and provides guidance on mitigation for affected WordPress installations.