CVE-2025-23708
Published: 16 January 2025
Description
Cross-Site Request Forgery (CSRF) vulnerability in Dominic Fallows DF Draggable df-draggable allows Stored XSS.This issue affects DF Draggable: from n/a through <= 1.13.2.
Security Summary
CVE-2025-23708 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the DF Draggable WordPress plugin (df-draggable) developed by Dominic Fallows. This flaw enables Stored XSS and affects all versions of the plugin up to and including 1.13.2.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, and user interaction such as clicking a malicious link. Unauthenticated attackers can exploit it by tricking authenticated users, typically administrators, into submitting a CSRF request that stores an XSS payload, leading to low-level impacts on confidentiality, integrity, and availability with a changed scope.
The Patchstack advisory provides further details on this WordPress plugin vulnerability, including mitigation guidance, at https://patchstack.com/database/Wordpress/Plugin/df-draggable/vulnerability/wordpress-df-draggable-plugin-1-13-2-csrf-to-stored-xss-vulnerability?_s_id=cve.
Details
- CWE(s)