CVE-2025-23627

CVE-2025-23627 is a Cross-Site Request Forgery (CSRF) vulnerability, mapped to CWE-352, in the frenchsquared Comment-Emailer WordPress plugin, affecting all versions from n/a through 1.0.5. The flaw enables Stored Cross-Site Scripting (XSS) when exploited via CSRF, as documented in the CVE description published on 2025-01-16.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no required privileges, though user interaction is necessary. Exploitation tricks a victim into submitting a malicious request, leading to stored XSS that can execute scripts in the context of other users viewing affected pages, achieving low impacts on confidentiality, integrity, and availability with a changed scope (CVSS:3.1 score of 7.1).

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/comment-emailer/vulnerability/wordpress-comment-emailer-plugin-1-0-5-csrf-to-stored-cross-site-scripting-vulnerability?_s_id=cve provides details on this WordPress plugin vulnerability, and security practitioners should review it for recommended mitigations such as updating the plugin or implementing CSRF protections.