CVE-2025-23694

CVE-2025-23694 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Shabbos and Yom Tov WordPress plugin developed by shabboscommerce. This flaw enables Stored XSS and affects all versions of the plugin up to and including 1.9, with no known lower bound specified.

Unauthenticated attackers (PR:N) can exploit the vulnerability remotely over the network (AV:N) with low attack complexity (AC:L), though it requires user interaction (UI:R) such as tricking an administrator into submitting a malicious request. Successful exploitation changes the scope to high (S:C), allowing attackers to inject and store malicious scripts that execute in the context of other users viewing affected pages, resulting in low impacts to confidentiality, integrity, and availability (C:L/I:L/A:L) for a CVSS v3.1 base score of 7.1.

The Patchstack advisory documents this CSRF-to-Stored XSS issue in the Shabbos and Yom Tov plugin version 1.9 and provides details on the vulnerability for WordPress site operators.