CVE-2025-23577
Published: 16 January 2025
Description
Cross-Site Request Forgery (CSRF) vulnerability in Sourov Amin Word Freshener word-freshener allows Stored XSS.This issue affects Word Freshener: from n/a through <= 1.3.
Security Summary
CVE-2025-23577 is a Cross-Site Request Forgery (CSRF) vulnerability in the Word Freshener WordPress plugin developed by Sourov Amin, which enables Stored XSS. The flaw affects the plugin from unknown initial versions through version 1.3 inclusive, as documented under CWE-352.
Unauthenticated attackers (PR:N) can exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L), though it requires user interaction (UI:R) such as tricking an authenticated administrator into visiting a malicious site or clicking a forged link. Successful exploitation changes scope (S:C) and allows limited impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), resulting in a CVSS v3.1 base score of 7.1, primarily through the injection and persistence of XSS payloads via CSRF-protected administrative actions.
Mitigation guidance is available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/word-freshener/vulnerability/wordpress-word-freshener-plugin-1-3-csrf-to-stored-xss-vulnerability?_s_id=cve, which details the vulnerability in the WordPress Word Freshener plugin version 1.3.
Details
- CWE(s)