CVE-2025-23810: Len Slider CSRF Vulnerability

CVE-2025-23810 Overview

CVE-2025-23810 is a Cross-Site Request Forgery (CSRF) vulnerability in the Igor Sazonov Len Slider WordPress plugin that allows an attacker to trigger Reflected Cross-Site Scripting (XSS). The flaw affects all versions of Len Slider up to and including 2.0.11. Successful exploitation requires an authenticated user to interact with an attacker-crafted request, after which arbitrary JavaScript executes in the victim's browser within the WordPress site context. The vulnerability is classified under CWE-352: Cross-Site Request Forgery.

Critical Impact
An attacker can hijack an authenticated administrator session, execute arbitrary JavaScript in the browser, and pivot to account takeover or persistent site compromise.

Affected Products

Igor Sazonov Len Slider WordPress plugin versions through 2.0.11
WordPress sites with the len-slider plugin installed and active
No fixed version is referenced in the available advisory data

Discovery Timeline

2025-01-16 - CVE-2025-23810 published to the National Vulnerability Database (NVD)
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-23810

Vulnerability Analysis

The Len Slider plugin processes requests without verifying request authenticity through anti-CSRF tokens (nonces). An attacker can construct a malicious URL or HTML form that, when visited by an authenticated user, submits a request to the plugin containing attacker-controlled input. That input is reflected back into the response without proper sanitization or output encoding, resulting in Reflected XSS.

The attack chains two weaknesses: missing CSRF protection and improper output encoding. The CSRF flaw enables the attacker to force the request, while the reflected XSS sink delivers the payload. User interaction is required, as the victim must click a crafted link or load a page controlled by the attacker.

Because the executed JavaScript runs in the WordPress origin, an attacker can read session cookies that lack HttpOnly, perform actions on behalf of the authenticated user, or inject persistent content if the victim holds administrative privileges.

Root Cause

The plugin omits WordPress nonce validation (wp_verify_nonce) on state- or output-affecting handlers and fails to escape reflected parameters using functions such as esc_html, esc_attr, or esc_url. This combination satisfies the conditions for CWE-352 escalation into XSS.

Attack Vector

The attack is delivered over the network and requires the victim to be authenticated to the WordPress site and to interact with an attacker-controlled link or page. The scope changes when the injected script executes against the WordPress origin, affecting resources beyond the vulnerable component.

Technical details and proof-of-concept information are documented in the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-23810

Indicators of Compromise

Unexpected outbound requests from administrator browsers shortly after clicking external links to the WordPress admin interface
HTTP requests to Len Slider plugin endpoints containing <script>, onerror=, javascript:, or URL-encoded variants in query parameters
New or modified WordPress users, plugins, or options created during an administrator session that originated from a suspicious referrer

Detection Strategies

Inspect web server access logs for requests to len-slider plugin paths with reflected parameters containing HTML or script metacharacters
Deploy a Web Application Firewall (WAF) rule that flags reflected XSS payloads in query strings against /wp-admin/ and plugin AJAX endpoints
Correlate Referer headers on plugin requests against expected admin workflows to identify cross-origin triggers consistent with CSRF

Monitoring Recommendations

Enable detailed WordPress audit logging for plugin configuration changes and administrative actions
Monitor browser Content Security Policy (CSP) violation reports for inline script execution on admin pages
Alert on administrator account changes, new privileged users, and modifications to active plugins or themes

How to Mitigate CVE-2025-23810

Immediate Actions Required

Deactivate the Len Slider plugin until a patched release is confirmed by the vendor
Force a password reset and re-authentication for all WordPress administrator accounts
Restrict /wp-admin/ access by IP allowlist where operationally feasible
Require administrators to log out of WordPress before browsing untrusted sites

Patch Information

No vendor-confirmed fixed version is listed in the available advisory data at the time of publication. Review the Patchstack Vulnerability Report for updates and apply the latest plugin release once the vendor issues a patch above version 2.0.11.

Workarounds

Remove the len-slider plugin directory from wp-content/plugins/ if the plugin is not business-critical
Deploy a WAF virtual patch that blocks requests to Len Slider endpoints containing HTML or script metacharacters in parameters
Enforce a strict Content Security Policy that disallows inline scripts on WordPress admin pages
Set authentication cookies with HttpOnly and SameSite=Lax or Strict attributes to limit cross-site request abuse

bash

# Example WAF rule (ModSecurity) blocking reflected XSS payloads to Len Slider endpoints
SecRule REQUEST_URI "@contains len-slider" \
  "chain,deny,status:403,id:1002025023810,msg:'CVE-2025-23810 CSRF-to-XSS attempt'"
  SecRule ARGS "@rx (?i)(<script|onerror=|javascript:|%3Cscript)" "t:none,t:urlDecode"