CVE-2025-23664 Overview
CVE-2025-23664 is a Cross-Site Request Forgery (CSRF) vulnerability in the Real Seguro Viagem WordPress plugin (seguro-viagem) that leads to Stored Cross-Site Scripting (XSS). The flaw affects all versions up to and including 2.0.5. An attacker can craft a malicious request that, when triggered by an authenticated user visiting an attacker-controlled page, injects persistent JavaScript into the WordPress site. The stored payload executes in the browser of any visitor who later renders the affected content, enabling session theft, account takeover, and content manipulation. The vulnerability is tracked under CWE-352 and has been documented by Patchstack.
Critical Impact
A successful attack chains CSRF with Stored XSS, allowing unauthenticated attackers to persist arbitrary JavaScript in a WordPress site by tricking a privileged user into clicking a crafted link.
Affected Products
- Real Seguro Viagem WordPress plugin (seguro-viagem)
- All versions from n/a through 2.0.5
- WordPress installations using the vulnerable plugin
Discovery Timeline
- 2025-01-16 - CVE-2025-23664 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-23664
Vulnerability Analysis
The vulnerability combines two weaknesses. First, the plugin's state-changing endpoints lack anti-CSRF tokens or referer validation. Second, user-supplied input processed through those endpoints is stored without proper sanitization or output encoding, producing Stored XSS.
The attack requires user interaction. An authenticated administrator or editor must visit an attacker-controlled page while logged into the target WordPress site. The browser automatically replays the user's session cookie to the vulnerable endpoint, causing the malicious payload to be written to the database.
Once stored, the JavaScript executes in the context of any user rendering the affected page. The scope-changed nature of XSS means an attack starting on the plugin's interface can impact the broader WordPress origin, including the administrative dashboard.
Root Cause
The root cause is missing CSRF protection on the plugin's request handlers. WordPress provides the wp_nonce_field() and check_admin_referer() primitives, but the affected plugin code does not invoke these checks before persisting input. Inadequate output escaping on the stored value compounds the issue and turns a CSRF write into a persistent XSS payload.
Attack Vector
Exploitation is network-based and requires no privileges on the target site. The attacker hosts a page containing an auto-submitting form or fetch() call targeting the vulnerable plugin endpoint. When a logged-in WordPress user with sufficient permissions loads that page, the request is sent with their cookies. The plugin accepts the request, stores the payload, and serves it back to subsequent visitors, where the script executes.
No public proof-of-concept exploit code is associated with this CVE. See the Patchstack Vulnerability Report for further technical context.
Detection Methods for CVE-2025-23664
Indicators of Compromise
- Unexpected <script>, onerror, or onload strings stored in plugin-managed database tables or wp_options entries related to seguro-viagem.
- WordPress admin sessions originating from suspicious referers pointing to external domains immediately before plugin configuration changes.
- Outbound browser requests from administrator sessions to unknown third-party domains shortly after viewing plugin pages.
Detection Strategies
- Audit the plugin's database entries for HTML or JavaScript content where plain text is expected.
- Review WordPress access logs for POST requests to plugin endpoints lacking a matching Referer header from the site's own domain.
- Inspect rendered plugin pages with a headless browser and flag any execution of inline or remote scripts not part of the plugin baseline.
Monitoring Recommendations
- Enable WordPress security plugins or a Web Application Firewall (WAF) to log CSRF-style cross-origin POST requests.
- Monitor file integrity and database changes for the seguro-viagem plugin tables and options.
- Alert on administrator account activity that follows visits to external URLs within the same browser session.
How to Mitigate CVE-2025-23664
Immediate Actions Required
- Deactivate the Real Seguro Viagem plugin until a patched version above 2.0.5 is confirmed available from the vendor.
- Force a password reset and session invalidation for all WordPress administrator and editor accounts.
- Review plugin-managed content and remove any injected <script> payloads or event-handler attributes from stored data.
Patch Information
At the time of the latest NVD update, no fixed version above 2.0.5 is referenced in the advisory. Monitor the Patchstack Vulnerability Report and the plugin's WordPress.org page for an updated release. Apply the vendor patch as soon as it becomes available.
Workarounds
- Remove or disable the seguro-viagem plugin from any WordPress installation running version 2.0.5 or earlier.
- Enforce a Content Security Policy (CSP) that restricts inline script execution to reduce the impact of stored XSS payloads.
- Require administrators to use separate browser profiles or sessions for WordPress administration to limit CSRF exposure.
# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate seguro-viagem
wp plugin delete seguro-viagem
# Verify removal
wp plugin list --status=active | grep -i seguro-viagem
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
