CVE-2025-23901

CVE-2025-23901 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the GravatarLocalCache WordPress plugin developed by cybio under the gravatarlocalcache package. This issue affects all versions from n/a through 1.1.2, with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Published on 2025-01-16, it enables CSRF attacks against the plugin's functionality.

Unauthenticated attackers can exploit this vulnerability over the network with low complexity and no required privileges, but it relies on user interaction such as tricking an authenticated user—typically a site administrator—into visiting a malicious webpage or clicking a crafted link. Successful exploitation changes the security scope and results in low impacts to confidentiality, integrity, and availability, potentially allowing actions like stored cross-site scripting (XSS) as indicated in vulnerability details.

Patchstack advisories document this as a CSRF-to-stored-XSS vulnerability specifically in GravatarLocalCache plugin version 1.1.2, providing further technical analysis for mitigation guidance. Security practitioners should review the referenced advisory at https://patchstack.com/database/Wordpress/Plugin/gravatarlocalcache/vulnerability/wordpress-gravatarlocalcache-plugin-1-1-2-csrf-to-stored-xss-vulnerability?_s_id=cve and apply updates or workarounds as recommended.