CVE-2025-23690

CVE-2025-23690 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the ArtkanMedia Book a Place WordPress plugin (book-a-place) that enables Stored XSS. Published on 2025-01-16, it affects all versions from unknown starting point through 0.7.1, with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

Unauthenticated attackers can exploit this over the network with low attack complexity by tricking authenticated users into interacting with a malicious request, such as via a crafted webpage. Successful exploitation allows injection of Stored XSS payloads through the CSRF vector, potentially leading to low-level impacts on confidentiality, integrity, and availability, with a changed scope that could affect other users viewing the stored content.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/book-a-place/vulnerability/wordpress-book-a-place-plugin-0-7-1-csrf-to-stored-xss-vulnerability?_s_id=cve documents the CSRF-to-Stored XSS vulnerability specifically in Book a Place plugin version 0.7.1 for WordPress.