CVE-2025-23659

CVE-2025-23659 is a Cross-Site Request Forgery (CSRF) vulnerability in the MercadoLibre Integration WordPress plugin (mercadolibre-integration) developed by hernanjh. The flaw allows for Stored XSS and affects all versions up to and including 1.1. It is classified under CWE-352 with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges, and scope change.

Attackers can exploit this vulnerability remotely without authentication by tricking authenticated users into interacting with a malicious webpage or link that submits a forged request to the vulnerable plugin. This user interaction (UI:R) enables the storage of malicious XSS payloads, which can then execute in the context of other users viewing affected pages, potentially leading to low-level impacts on confidentiality, integrity, and availability, such as session hijacking, data theft, or site defacement.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/mercadolibre-integration/vulnerability/wordpress-mercadolibre-integration-plugin-1-1-csrf-to-stored-cross-site-scripting-vulnerability?_s_id=cve provides details on the vulnerability, including recommended mitigations such as updating to a patched version beyond 1.1 or applying available security configurations for WordPress sites using this plugin.