CVE-2025-24561

CVE-2025-24561 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the ReviewsTap WordPress plugin developed by awcode. This flaw enables Stored Cross-Site Scripting (XSS) and affects all versions of ReviewsTap up to and including 1.1.2. The vulnerability received a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), highlighting its network accessibility, low attack complexity, lack of required privileges, and dependence on user interaction, with impacts across confidentiality, integrity, and availability in a changed scope.

Attackers can exploit this vulnerability remotely without authentication by crafting a malicious webpage or link that, when visited by a legitimate user (such as a site administrator), triggers a CSRF request to the vulnerable ReviewsTap plugin. This allows the storage of an XSS payload, which executes in the context of the plugin for subsequent users or admins viewing affected content, potentially leading to session hijacking, data theft, or further site compromise.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/reviewstap/vulnerability/wordpress-reviewstap-plugin-1-1-2-csrf-to-stored-cross-site-scripting-vulnerability?_s_id=cve details the CSRF-to-Stored XSS issue in ReviewsTap version 1.1.2 and earlier, recommending updates to a fixed version of the plugin for mitigation. Security practitioners should verify plugin updates via the official WordPress repository and implement CSRF protections where possible.