CVE-2025-23698

CVE-2025-23698 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the WP Custom Google Search WordPress plugin developed by ivanra10. This flaw enables Stored XSS and affects all versions of the plugin from n/a through 1.0 inclusive. Published on 2025-01-16, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility and scope change.

The vulnerability can be exploited by unauthenticated attackers over the network with low attack complexity, though it requires user interaction from an authenticated victim, such as a site administrator. By tricking the victim into performing a malicious request via a forged page, attackers can inject and store XSS payloads, potentially leading to script execution in the context of the WordPress site, with low impacts on confidentiality, integrity, and availability.

Patchstack's advisory provides details on the vulnerability in the WP Custom Google Search plugin version 1.0, recommending mitigation through plugin updates where available or removal of the affected plugin. Security practitioners should consult https://patchstack.com/database/Wordpress/Plugin/wp-custom-google-search/vulnerability/wordpress-wp-custom-google-search-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve for full remediation guidance.