CVE-2025-23832

CVE-2025-23832 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Admin Cleanup (admin-cleanup) developed by Matt Gibbs that enables Stored XSS. The issue affects all versions of the plugin from n/a through 1.0.2 inclusive. It is associated with CWE-352 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility, low complexity, lack of required privileges, and scope change.

Attackers can exploit this vulnerability remotely without authentication by tricking authenticated users, such as site administrators, into performing unintended actions via a malicious webpage (user interaction required). This CSRF leads to Stored XSS, allowing injection of malicious scripts that persist on the site and execute in the victim's browser context, potentially resulting in low-level impacts on confidentiality, integrity, and availability.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/admin-cleanup/vulnerability/wordpress-admin-cleanup-plugin-1-0-2-csrf-to-stored-xss-vulnerability?_s_id=cve documents the vulnerability details. The affected version scope implies mitigation through updating to a version beyond 1.0.2.