CVE-2025-23808: Custom List Table Example CSRF Vulnerability

CVE-2025-23808 Overview

CVE-2025-23808 is a Cross-Site Request Forgery (CSRF) vulnerability in the Dutch van Andel Custom List Table Example WordPress plugin that chains into Reflected Cross-Site Scripting (XSS). The flaw affects all plugin versions up to and including 1.4.1. An unauthenticated attacker can craft a malicious request that, when triggered by an authenticated victim, reflects attacker-controlled script into the victim's browser session. The weakness is classified under CWE-352: Cross-Site Request Forgery.

Critical Impact

Successful exploitation allows attackers to execute arbitrary JavaScript in an authenticated administrator's browser context, leading to session compromise, privileged action abuse, and potential site takeover when the victim clicks a crafted link.

Affected Products

• Dutch van Andel Custom List Table Example WordPress plugin (custom-list-table-example)
• All versions from initial release through 1.4.1
• WordPress installations with the vulnerable plugin activated

Discovery Timeline

• 2025-01-16 - CVE-2025-23808 published to the National Vulnerability Database (NVD)
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-23808

Vulnerability Analysis

The vulnerability is a CSRF-to-Reflected-XSS chain. The plugin processes a request handler that reflects user-supplied input back into the rendered HTML response without sufficient output encoding. The handler also lacks a valid CSRF nonce verification step, so requests originating from external domains are accepted as legitimate when a logged-in user triggers them.

An attacker hosts a page containing a forged request targeting the plugin endpoint. When a WordPress administrator visits the page while authenticated, the browser submits the request with the user's session cookies. The plugin reflects the attacker-supplied parameter into the response, executing JavaScript under the WordPress origin.

This chain expands the impact of a standard reflected XSS issue. The user-interaction requirement is reduced to a single click on an attacker-controlled link or page, and the lack of CSRF protection means the attacker does not need prior knowledge of any token or session data.

Root Cause

The root cause is twofold. First, the plugin omits WordPress nonce validation (wp_verify_nonce or check_admin_referer) on a request-handling path that processes user input. Second, parameters supplied to that path are echoed into HTML output without escaping through functions such as esc_html or esc_attr. The combination of missing CSRF protection [CWE-352] and missing output sanitization creates the reflected XSS condition.

Attack Vector

The attack is network-based and requires user interaction. An attacker crafts a URL or HTML form referencing the vulnerable plugin endpoint with a malicious payload in a reflected parameter. The attacker delivers the link through phishing, forum posts, or a compromised page. When an authenticated WordPress user with access to the plugin context loads the resource, the script executes in their browser. Because the scope is changed to the WordPress admin origin, the script can read cookies, perform privileged actions, or modify site content.

No verified public proof-of-concept code is available. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-23808

Indicators of Compromise

• Outbound HTTP referrers from unexpected external domains pointing at wp-admin URLs containing the plugin's query parameters
• Unexpected administrative actions, new users, or modified plugin/theme files following an admin's click on an external link
• Browser console errors or content-security-policy violations referencing inline <script> tags injected via query strings
• Web server access logs showing requests to plugin endpoints with encoded <script>, onerror=, or javascript: substrings in parameters

Detection Strategies

• Inspect WordPress access logs for GET or POST requests to custom-list-table-example endpoints containing HTML or JavaScript metacharacters in parameter values
• Deploy a Web Application Firewall (WAF) rule that flags reflected parameters echoing <, >, or script tokens in responses
• Use a vulnerability scanner that fingerprints WordPress plugin versions and flags custom-list-table-example at 1.4.1 or earlier

Monitoring Recommendations

• Enable WordPress audit logging for administrator session activity and correlate with referrer headers
• Alert on creation of administrator accounts, plugin installations, or option changes performed outside known maintenance windows
• Monitor browser-side telemetry for anomalous script execution on /wp-admin/ pages

How to Mitigate CVE-2025-23808

Immediate Actions Required

• Deactivate and remove the custom-list-table-example plugin until a patched version is confirmed and installed
• Force a password reset and session invalidation for all WordPress administrator accounts on affected sites
• Audit administrator activity logs for unauthorized changes made since the plugin was deployed

Patch Information

No fixed version is listed in the advisory at the time of publication. The vulnerability affects all releases through 1.4.1. Site operators should monitor the Patchstack Vulnerability Report and the plugin's repository for a security release before re-enabling the plugin.

Workarounds

• Remove the plugin entirely if it is not essential, since it ships as a developer example rather than a production utility
• Restrict /wp-admin/ access to known IP ranges via web server or WAF rules to reduce CSRF attack surface
• Enforce a strict Content Security Policy (CSP) on WordPress admin pages to block inline script execution from reflected payloads
• Train administrators to avoid clicking external links while authenticated to WordPress administration sessions

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate custom-list-table-example
wp plugin delete custom-list-table-example

# Verify removal
wp plugin list --status=active | grep custom-list-table-example