CVE-2025-23703

CVE-2025-23703 is a Cross-Site Request Forgery (CSRF) vulnerability in the Free MailClient FMC WordPress plugin by cstoltenkamp that allows Stored XSS. The issue affects the plugin from unknown initial versions through 1.0 inclusive, as documented under CWE-352.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating exploitation over the network with low complexity, no required privileges, and user interaction. An unauthenticated attacker can trick an authenticated user into submitting a malicious request via a crafted webpage, resulting in the storage of XSS payloads that execute with changed scope and low impacts on confidentiality, integrity, and availability.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/mailclient/vulnerability/wordpress-free-mailclient-fmc-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve.