CVE-2025-25160

CVE-2025-25160 is a Cross-Site Request Forgery (CSRF) vulnerability in the Mark Barnes Style Tweaker WordPress plugin (style-tweaker) that enables Stored XSS. This issue affects the plugin from unknown initial versions through version 0.11 inclusive, as documented under CWE-352. The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, necessary user interaction, and changed scope with low impacts across confidentiality, integrity, and availability.

An attacker can exploit this vulnerability by crafting a malicious webpage or link that, when visited by an authenticated WordPress user with sufficient privileges (such as an administrator capable of style tweaks), triggers a CSRF request to the plugin's endpoint. This results in the storage of malicious XSS payloads within the site's styles, which then execute in the context of other users viewing affected pages. Exploitation requires user interaction but no prior authentication or privileges on the attacker's part, potentially allowing session hijacking, data theft, or further site compromise within the plugin's scope.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/style-tweaker/vulnerability/wordpress-style-tweaker-plugin-0-11-csrf-to-stored-xss-vulnerability?_s_id=cve. The vulnerability was published on 2025-02-07.