CVE-2025-23639: MDC YouTube Downloader CSRF Vulnerability

CVE-2025-23639 Overview

CVE-2025-23639 is a Cross-Site Request Forgery (CSRF) vulnerability in the Nazmul Ahsan MDC YouTube Downloader WordPress plugin. The flaw affects all versions of mdc-youtube-downloader up to and including 3.0.0. Successful exploitation chains CSRF with Stored Cross-Site Scripting (XSS), enabling attackers to inject persistent malicious scripts into the WordPress site. The vulnerability maps to CWE-352: Cross-Site Request Forgery and requires user interaction from an authenticated administrator to trigger the malicious request.

Critical Impact
An attacker who tricks an authenticated administrator into visiting a crafted page can inject persistent JavaScript that executes in the browser of every visitor viewing affected pages.

Affected Products

Nazmul Ahsan MDC YouTube Downloader (mdc-youtube-downloader) WordPress plugin
All versions from n/a through <= 3.0.0
WordPress sites with the plugin activated and administrator sessions active

Discovery Timeline

2025-01-16 - CVE-2025-23639 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23639

Vulnerability Analysis

The plugin exposes state-changing administrative actions without validating anti-CSRF tokens. An attacker hosts a malicious page containing an auto-submitting form or crafted request that targets the plugin's settings endpoint. When an authenticated administrator visits the attacker-controlled page, the browser forwards the administrator's session cookies with the forged request. The plugin processes the request as legitimate.

Because the affected endpoint also fails to sanitize input, the attacker-supplied payload is persisted in the database. Any subsequent page that renders this stored value executes the injected script in the visitor's browser, producing Stored XSS. This yields a scope change: code introduced through an administrator session executes against unprivileged site visitors.

Impact includes session token theft, administrative account takeover, malicious redirects, drive-by malware delivery, and defacement. EPSS data reports a probability of 0.165% with a percentile of 6.133, indicating low observed exploitation activity to date.

Root Cause

The root cause is missing CSRF protection on plugin request handlers. WordPress provides the wp_nonce_field() and check_admin_referer() primitives for this purpose. The plugin does not generate or validate nonces on the vulnerable action, and it does not enforce output encoding on the stored value, enabling the CSRF-to-XSS chain.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker crafts an HTML page containing a hidden form that POSTs to the vulnerable plugin endpoint on the target WordPress site. The form payload contains a JavaScript string in a field the plugin persists without sanitization. The attacker delivers the URL via phishing, forum posts, or comments. When an administrator opens the page while logged in, the browser submits the request with valid session cookies, storing the XSS payload for later execution against site visitors.

No verified proof-of-concept code is publicly available. Refer to the Patchstack Vulnerability Report for technical details.

Detection Methods for CVE-2025-23639

Indicators of Compromise

Unexpected <script> tags, iframes, or JavaScript event handlers stored in MDC YouTube Downloader plugin settings or post metadata
WordPress admin POST requests to plugin endpoints originating from external Referer headers unrelated to the site's own admin pages
Outbound browser traffic from site visitors to unfamiliar domains after loading pages that render plugin output
New or modified administrator accounts appearing shortly after suspicious admin sessions

Detection Strategies

Audit the WordPress database for plugin-controlled fields containing HTML or JavaScript syntax such as <script, onerror=, or javascript: URIs
Enable and review WordPress activity logs for plugin setting changes correlated with admin sessions that originated from external referrers
Deploy a web application firewall (WAF) rule that flags POST requests to plugin admin endpoints lacking a valid _wpnonce parameter

Monitoring Recommendations

Log all administrator-level POST requests to /wp-admin/ and /wp-admin/admin-post.php with full referrer and user-agent context
Alert on stored plugin configuration values containing angle brackets, script keywords, or encoded JavaScript payloads
Monitor Content Security Policy (CSP) violation reports for inline script executions on public pages that render plugin output

How to Mitigate CVE-2025-23639

Immediate Actions Required

Deactivate and remove the MDC YouTube Downloader plugin until a patched release is confirmed and applied
Rotate all WordPress administrator credentials and force logout of active sessions to invalidate potentially stolen cookies
Inspect and clean plugin-related database records for injected script content before reactivating
Require administrators to use dedicated browsers or profiles for WordPress admin activity to reduce CSRF exposure

Patch Information

At the time of publication, no fixed version beyond 3.0.0 is listed in the NVD entry. Consult the Patchstack Vulnerability Report and the plugin's official page for the latest patch status before reinstalling.

Workarounds

Restrict /wp-admin/ access by source IP address using web server or WAF rules to limit CSRF reachability
Deploy a strict Content Security Policy that disallows inline scripts (script-src 'self') on public pages to blunt XSS execution
Add SameSite=Strict or SameSite=Lax attributes to WordPress authentication cookies to prevent cross-site cookie transmission
Enforce two-factor authentication on all administrator accounts to reduce the impact of session compromise

bash

# Example nginx configuration to restrict wp-admin access and add CSP
location ^~ /wp-admin/ {
    allow 203.0.113.0/24;   # trusted admin network
    deny all;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; frame-ancestors 'none';" always;
    add_header X-Frame-Options "DENY" always;
}