CVE-2025-23821: WP Cookies Alert CSRF Vulnerability

CVE-2025-23821 Overview

CVE-2025-23821 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP Cookies Alert WordPress plugin developed by aleapp. The flaw affects all plugin versions up to and including 1.1.1. Attackers can chain the CSRF weakness to inject stored Cross-Site Scripting (XSS) payloads into the plugin configuration. Exploitation requires an authenticated administrator to visit an attacker-controlled page or click a crafted link. The issue is tracked under CWE-352: Cross-Site Request Forgery and documented by Patchstack.

Critical Impact
A successful CSRF-to-stored-XSS chain lets attackers execute arbitrary JavaScript in administrator browsers, leading to account takeover, content tampering, and persistent site compromise.

Affected Products

aleapp WP Cookies Alert plugin for WordPress
All versions from n/a through 1.1.1
WordPress sites running the vulnerable plugin with administrative users

Discovery Timeline

2025-01-16 - CVE-2025-23821 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-23821

Vulnerability Analysis

The WP Cookies Alert plugin exposes administrative settings endpoints that process state-changing requests without verifying a valid WordPress nonce or equivalent anti-CSRF token. An attacker who lures an authenticated administrator to a malicious page can force the victim's browser to submit forged requests to the plugin's settings handler. Because the plugin also fails to sanitize submitted input on storage, the forged request persists attacker-controlled markup. When an administrator later loads the affected settings page or any page that renders the stored content, the injected JavaScript executes in the administrator's session context.

The scope-changed nature of the issue means the malicious script can reach data and functionality outside the originally vulnerable component, including session cookies, REST API tokens, and other administrative pages.

Root Cause

The root cause is the absence of CSRF protection on plugin actions that modify persistent configuration, combined with insufficient output encoding. WordPress provides wp_nonce_field(), check_admin_referer(), and wp_verify_nonce() to bind requests to authenticated sessions, but the vulnerable handlers omit these checks.

Attack Vector

An attacker hosts a page containing an auto-submitting HTML form or JavaScript fetch call targeting the plugin's settings endpoint on a victim WordPress site. The attacker tricks an authenticated administrator into visiting that page through phishing, a comment link, or a watering-hole site. The browser sends the forged POST request with the administrator's cookies attached. The plugin processes the request, stores the attacker's payload, and executes the injected script when the page is later rendered. User interaction is required, but no credentials are needed by the attacker.

Refer to the Patchstack advisory for WP Cookies Alert for full technical context.

Detection Methods for CVE-2025-23821

Indicators of Compromise

Unexpected <script>, onerror, or onload attributes stored in wp_options rows associated with the wp-cookies-alert plugin.
Administrator HTTP POST requests to plugin settings URLs originating from external Referer headers unrelated to wp-admin.
New or modified WordPress administrator accounts created shortly after an admin browsed an untrusted site.
Outbound requests from browsers loading WordPress admin pages to unfamiliar third-party domains.

Detection Strategies

Scan plugin settings stored in the database for HTML or JavaScript characters such as <, >, and javascript: substrings.
Inspect web server access logs for POST requests to wp-admin/admin.php or admin-post.php actions tied to the plugin without valid _wpnonce parameters.
Monitor browser-side telemetry for script execution sourced from WordPress administrative pages.

Monitoring Recommendations

Enable WordPress audit logging to capture option changes and plugin setting updates with user attribution.
Alert on cross-origin form submissions to /wp-admin/ paths through a Web Application Firewall (WAF).
Track creation of administrator accounts, changes to siteurl and home options, and new scheduled tasks (wp_cron).

How to Mitigate CVE-2025-23821

Immediate Actions Required

Deactivate and remove the WP Cookies Alert plugin until a vendor patch is confirmed beyond version 1.1.1.
Audit wp_options and plugin-specific tables for malicious stored content and remove any injected payloads.
Force a password reset and re-authentication for all administrator accounts on affected sites.
Rotate WordPress secret keys in wp-config.php to invalidate stolen session cookies.

Patch Information

At the time of publication, no fixed version above 1.1.1 is referenced in the available advisories. Monitor the Patchstack advisory and the WordPress plugin repository for an official update.

Workarounds

Replace WP Cookies Alert with a maintained cookie consent plugin that enforces nonce verification.
Deploy a WAF rule that blocks POST requests to wp-admin endpoints lacking a valid _wpnonce or matching same-origin Referer.
Restrict administrator browsing on production WordPress hosts to reduce CSRF exposure.
Apply Content Security Policy (CSP) headers to limit inline script execution in the WordPress admin interface.

bash

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate wp-cookies-alert
wp plugin delete wp-cookies-alert

# Rotate WordPress salts after suspected compromise
wp config shuffle-salts