CVE-2025-23820

CVE-2025-23820 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Content Security Policy Pro WordPress plugin developed by thapa.laxman. The flaw affects all versions of the plugin from n/a through 1.3.5 inclusive. Published on 2025-01-16, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges, and scope change.

Unauthenticated attackers (PR:N) can exploit this over the network (AV:N) by tricking authenticated users into performing unintended actions via malicious websites or links, as user interaction is required (UI:R). Successful exploitation enables low-level impacts on confidentiality, integrity, and availability (C:L/I:L/A:L) within a changed scope (S:C), allowing forged requests to manipulate plugin functionality.

The Patchstack advisory provides further details on this CSRF issue in the Content Security Policy Pro plugin at https://patchstack.com/database/Wordpress/Plugin/content-security-policy-pro/vulnerability/wordpress-content-security-policy-pro-plugin-1-3-5-csrf-to-stored-xss-vulnerability?_s_id=cve, including recommended mitigations such as updating to a version beyond 1.3.5.