CVE-2025-23560

CVE-2025-23560 is a Cross-Site Request Forgery (CSRF) vulnerability in the plumwd Web Testimonials WordPress plugin (web-testimonials) that enables Stored Cross-Site Scripting (XSS). Published on 2025-01-16, the issue affects all versions from unknown starting point through 1.2 inclusive and is associated with CWE-352.

With a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the vulnerability is exploitable over the network with low attack complexity and no privileges required, though it demands user interaction. An attacker can trick an authenticated user, such as a site administrator, into performing an unintended action via a forged request, leading to the storage of malicious XSS payloads on the site. This results in low impacts to confidentiality, integrity, and availability within a changed scope, allowing script execution in the context of other users viewing the testimonials.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/web-testimonials/vulnerability/wordpress-web-testimonials-plugin-1-2-csrf-to-stored-xss-vulnerability?_s_id=cve provides further details on the vulnerability.