CVE-2025-28923

CVE-2025-28923, published on 2025-03-11, is a Cross-Site Request Forgery (CSRF) vulnerability classified under CWE-352 in the WordPress plugin "No Disposable Email" developed by philippe. The flaw enables Stored XSS and affects all versions of the plugin from unknown initial release through 2.5.1. It carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), reflecting network-based exploitation with low complexity, no required privileges, user interaction, and scope change leading to low impacts across confidentiality, integrity, and availability.

Attackers can exploit this vulnerability without authentication by crafting a malicious webpage that tricks a logged-in user, typically a site administrator, into submitting a forged request to the plugin's endpoint via user interaction such as clicking a link or loading an image. Successful CSRF triggers Stored XSS, allowing attackers to inject and persist malicious scripts on the WordPress site, which execute in victims' browsers upon page access, potentially enabling session hijacking, data theft, or further attacks on site visitors.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/no-disposable-email/vulnerability/wordpress-no-disposable-email-plugin-2-5-1-csrf-to-stored-xss-vulnerability?_s_id=cve details the vulnerability in the No Disposable Email plugin version 2.5.1 and recommends mitigation through updating to a patched version beyond 2.5.1.