CVE-2025-23805
Published: 16 January 2025
Description
An adversary may rely upon a user clicking a malicious link in order to gain execution.
Security Summary
CVE-2025-23805 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the SEOReseller Partner (sr-partner) WordPress plugin developed by itamarg. This issue affects all versions of the plugin from unknown initial release through 1.3.15. Published on 2025-01-16, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
An unauthenticated network attacker can exploit this vulnerability by tricking an authenticated user into interacting with a maliciously crafted request, such as clicking a link or visiting a forged page. Exploitation requires low complexity but user interaction, and it changes scope to achieve low impacts across confidentiality, integrity, and availability.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/sr-partner/vulnerability/wordpress-seoreseller-partner-plugin-1-3-15-csrf-to-stored-xss-vulnerability?_s_id=cve details this as a CSRF-to-stored XSS vulnerability in SEOReseller Partner plugin version 1.3.15.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
CSRF-to-stored-XSS in public-facing WordPress plugin directly enables exploitation of the web application via malicious links that trick authenticated users.