CVE-2025-23822: Category Custom Fields CSRF Vulnerability

CVE-2025-23822 Overview

CVE-2025-23822 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Category Custom Fields WordPress plugin developed by alicornea. The flaw impacts all plugin versions up to and including 1.0. According to the Patchstack advisory, the CSRF weakness chains into a stored Cross-Site Scripting (XSS) condition, allowing attackers to persist malicious payloads through forged authenticated requests. The vulnerability is categorized under CWE-352: Cross-Site Request Forgery.

Critical Impact
An unauthenticated attacker can trick an authenticated administrator into submitting a forged request that injects persistent JavaScript into category custom fields, leading to stored XSS execution in the WordPress admin context.

Affected Products

alicornea Category Custom Fields plugin for WordPress
All versions through 1.0
WordPress installations with the categorycustomfields plugin active

Discovery Timeline

2025-01-16 - CVE-2025-23822 published to the National Vulnerability Database
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-23822

Vulnerability Analysis

The Category Custom Fields plugin fails to validate the origin of state-changing requests submitted to its administrative endpoints. State-changing operations that modify category custom field data do not verify a WordPress nonce or equivalent anti-CSRF token. An attacker who lures an authenticated administrator to a malicious page can issue cross-origin requests that the browser submits with valid session cookies.

Because user-supplied data passed through this CSRF flow is also rendered without adequate output encoding, the attack escalates from CSRF to stored XSS. The injected JavaScript persists in the database and executes for any user viewing the affected category data. The attack requires user interaction (UI:R) and crosses a trust boundary (Scope: Changed), which broadens the impact beyond the vulnerable component.

Root Cause

The root cause is the absence of CSRF protection on plugin endpoints that modify category custom fields. WordPress provides nonce APIs such as wp_nonce_field(), check_admin_referer(), and wp_verify_nonce() to mitigate forged request submission. The plugin omits these checks, treating any authenticated request as legitimate. Compounding the issue, input persisted via these endpoints is not sanitized with functions such as sanitize_text_field() or escaped on output with esc_html() or esc_attr().

Attack Vector

Exploitation requires an attacker-controlled web page and a victim with administrative privileges on the target WordPress site. The attacker crafts an HTML form or JavaScript fetch request targeting the vulnerable plugin endpoint. When the administrator visits the malicious page while logged in, the browser automatically attaches session cookies, and the request executes server-side. The payload stored in category custom fields then triggers JavaScript execution whenever the data is rendered. Refer to the Patchstack Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2025-23822

Indicators of Compromise

Unexpected <script> tags, event handlers, or JavaScript URI schemes stored within WordPress category custom field metadata.
HTTP POST requests to plugin admin endpoints lacking a valid _wpnonce parameter in webserver access logs.
Cross-origin Referer headers on requests that modify category custom field configurations.
Unexplained administrator-initiated changes to category metadata correlating with browsing activity to external domains.

Detection Strategies

Audit the WordPress wp_termmeta and related tables for category custom field values containing HTML or script content.
Inspect plugin source code for missing check_admin_referer() or wp_verify_nonce() calls in request handlers.
Deploy a web application firewall rule to flag POST requests to categorycustomfields endpoints originating from external referers.
Enable WordPress activity logging to capture changes to category taxonomy and correlate with administrator session activity.

Monitoring Recommendations

Monitor administrator browser sessions for outbound requests to unknown domains followed by category metadata modifications.
Alert on Content Security Policy violation reports indicating inline script execution in the WordPress admin interface.
Track plugin version inventory and flag any WordPress site still running Category Custom Fields version 1.0 or earlier.

How to Mitigate CVE-2025-23822

Immediate Actions Required

Deactivate and remove the Category Custom Fields plugin until a patched version is confirmed available from the vendor.
Review all category custom field values and remove any unexpected HTML or JavaScript content stored in the database.
Force a password reset for WordPress administrators and invalidate active sessions to mitigate stolen credential reuse from successful XSS execution.
Restrict WordPress administrator browsing habits by enforcing dedicated admin browsers or session isolation.

Patch Information

At the time of NVD publication, the advisory lists the vulnerability as affecting versions up to and including 1.0 with no fixed version documented. Site administrators should consult the Patchstack Vulnerability Advisory and the WordPress plugin repository for the latest fix status. If no patch is available, removing the plugin is the recommended action.

Workarounds

Uninstall the plugin and replace its functionality with an actively maintained alternative that implements nonce verification.
Deploy a web application firewall ruleset that requires a valid Referer header matching the site origin on admin POST requests.
Implement a strict Content Security Policy in the WordPress admin area to block inline script execution.
Limit administrative access using IP allowlists or VPN-only access to the /wp-admin/ directory.

bash

# Example: Apache rule to restrict wp-admin access to a trusted IP range
<Directory "/var/www/html/wp-admin">
    Require ip 203.0.113.0/24
</Directory>

# Example: nginx CSP header to mitigate stored XSS execution in admin
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';" always;