CVE-2025-23617 Overview
CVE-2025-23617 is a Cross-Site Request Forgery (CSRF) vulnerability in the cybio Floatbox Plus WordPress plugin that leads to Stored Cross-Site Scripting (XSS). The flaw affects all versions of floatbox-plus up to and including 1.4.4. An attacker can craft a malicious request that, when triggered by an authenticated administrator visiting an attacker-controlled page, injects persistent JavaScript into the WordPress site. The vulnerability maps to CWE-352 (Cross-Site Request Forgery) and exploits the absence of anti-CSRF tokens on plugin configuration endpoints.
Critical Impact
Successful exploitation allows attackers to inject stored JavaScript into pages served by a vulnerable WordPress site, leading to session theft, administrative account compromise, and site-wide defacement or redirection.
Affected Products
- cybio Floatbox Plus WordPress plugin versions up to and including 1.4.4
- WordPress sites with the floatbox-plus plugin active
- Administrator accounts on affected WordPress installations
Discovery Timeline
- 2025-01-16 - CVE-2025-23617 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-23617
Vulnerability Analysis
The vulnerability chains two weaknesses. The plugin first fails to validate the origin or include a CSRF nonce on state-changing requests. It then stores user-supplied input without sufficient output encoding, allowing script content to persist in the database. An attacker who lures an authenticated administrator to a malicious page can submit a forged request that writes attacker-controlled JavaScript into plugin settings rendered on the site.
The stored payload executes in the browser of every visitor who loads the affected page. Because the script runs in the WordPress origin, it can read administrator cookies, perform privileged actions through the REST API, or inject persistent backdoor accounts. The interaction requirement increases the attack scope, since the victim must be authenticated and tricked into visiting a hostile page.
Root Cause
The root cause is the lack of CSRF protection on the plugin's settings handler combined with missing sanitization of stored values. WordPress provides wp_nonce_field() and check_admin_referer() helpers to prevent forged submissions, and esc_html() or wp_kses() to neutralize HTML in stored data. Floatbox Plus does not apply these controls consistently through version 1.4.4.
Attack Vector
An attacker hosts a malicious page containing a hidden form or fetch() call that targets the vulnerable plugin endpoint. When a logged-in WordPress administrator visits this page, the browser submits the request with valid authentication cookies. The forged request stores a JavaScript payload such as a <script> tag in plugin configuration. The script then executes whenever the affected component is rendered.
The vulnerability requires no privileges from the attacker and is exploitable over the network. See the Patchstack WordPress Vulnerability Advisory for technical details.
Detection Methods for CVE-2025-23617
Indicators of Compromise
- Unexpected <script>, <iframe>, or onerror= content in wp_options rows associated with Floatbox Plus settings.
- Outbound requests from visitor browsers to unknown domains following page loads that include Floatbox Plus components.
- Administrator sessions originating from unfamiliar IP addresses shortly after visiting external links.
- New administrator accounts or modified user roles in wp_users and wp_usermeta without a matching audit trail.
Detection Strategies
- Audit wp_options and plugin-specific tables for HTML or JavaScript fragments stored in Floatbox Plus configuration fields.
- Monitor WordPress access logs for POST requests to plugin admin endpoints lacking a corresponding Referer from the site's own admin domain.
- Deploy a Web Application Firewall (WAF) rule that blocks cross-origin POST submissions to /wp-admin/admin.php endpoints related to floatbox-plus.
Monitoring Recommendations
- Enable WordPress audit logging to capture configuration changes to active plugins.
- Alert on creation or modification of administrator accounts and on changes to plugin settings outside of maintenance windows.
- Inspect browser Content Security Policy (CSP) violation reports for script-src violations originating from plugin-rendered pages.
How to Mitigate CVE-2025-23617
Immediate Actions Required
- Deactivate the Floatbox Plus plugin until a patched release above 1.4.4 is verified and installed.
- Force a logout of all administrator sessions and rotate administrator passwords and application passwords.
- Review and remove any unexpected administrator accounts, modified plugin settings, or injected script content from the database.
Patch Information
As of the last NVD update on 2026-04-23, the advisory lists all versions through 1.4.4 as affected. Administrators should consult the Patchstack advisory and the WordPress plugin repository for a fixed release and apply it as soon as available.
Workarounds
- Restrict access to /wp-admin/ using IP allowlisting at the web server or WAF layer to limit who can be targeted by CSRF.
- Enforce a strict Content Security Policy that disallows inline scripts and limits script sources to trusted origins.
- Require administrators to use separate browser profiles or sessions for WordPress management to reduce CSRF exposure from general browsing.
# Apache configuration example: restrict wp-admin to a trusted CIDR
<Location "/wp-admin">
Require ip 203.0.113.0/24
</Location>
# Add a Content Security Policy header to mitigate stored XSS execution
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
