CVE-2025-23661

CVE-2025-23661 is a Cross-Site Request Forgery (CSRF) vulnerability in the NV Slider WordPress plugin by ryscript (nv-slider), which enables Stored Cross-Site Scripting (XSS). This issue affects all versions of the plugin from n/a through 1.6 inclusive. The vulnerability is classified under CWE-352 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no privileges required, user interaction needed, changed scope, and low impacts across confidentiality, integrity, and availability.

An attacker can exploit this vulnerability remotely without authentication by tricking a logged-in user (such as an administrator) into interacting with a malicious webpage or link that submits a forged request to the vulnerable plugin endpoint. This CSRF action injects a stored XSS payload into slider content, which then executes arbitrary JavaScript in the browsers of subsequent users viewing the affected sliders, potentially leading to session hijacking, data theft, or further site compromise.

Patchstack's advisory documents this CSRF-to-Stored XSS vulnerability specifically in NV Slider version 1.6 and provides details on affected installations: https://patchstack.com/database/Wordpress/Plugin/nv-slider/vulnerability/wordpress-nv-slider-plugin-1-6-csrf-to-stored-cross-site-scripting-vulnerability?_s_id=cve.