CVE-2025-25104

CVE-2025-25104 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the WordPress plugin URL-Preview-Box (also referred to as good-url-preview-box by author mraliende). It affects all versions up to and including 1.20. The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), reflecting its network-based exploitability with low attack complexity, no required privileges, user interaction dependency, changed scope, and low impacts across confidentiality, integrity, and availability.

Attackers can exploit this remotely without authentication by luring authenticated users—typically site administrators—into visiting a malicious webpage that forges requests to the vulnerable plugin endpoint. Successful exploitation enables the storage of malicious payloads, escalating to stored XSS as noted in related advisories, allowing script execution in the context of other users viewing affected content.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/good-url-preview-box/vulnerability/wordpress-url-preview-box-plugin-1-20-csrf-to-stored-xss-vulnerability?_s_id=cve details the CSRF-to-stored-XSS issue in version 1.20 and provides guidance on mitigation, including plugin updates where available or other protective measures.