CVE-2025-23617

CVE-2025-23617 is a Cross-Site Request Forgery (CSRF) vulnerability in the Floatbox Plus WordPress plugin by cybio (floatbox-plus) that allows Stored XSS. The issue affects Floatbox Plus versions from n/a through 1.4.4.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, user interaction, changed scope, and low impacts to confidentiality, integrity, and availability. Unauthenticated attackers can exploit it by tricking authenticated users (such as administrators) into performing unintended actions via forged requests, leading to the storage and execution of malicious XSS payloads visible to other users.

The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/floatbox-plus/vulnerability/wordpress-floatbox-plus-plugin-1-4-4-csrf-to-stored-xss-vulnerability?_s_id=cve) documents the CSRF-to-Stored XSS vulnerability specifically in Floatbox Plus version 1.4.4.