CVE-2025-23900: Genki Announcement CSRF Vulnerability

CVE-2025-23900 Overview

CVE-2025-23900 is a Cross-Site Request Forgery (CSRF) vulnerability in the genki-announcement WordPress plugin developed by genkisan. The flaw affects all versions up to and including 1.4.1. According to the Patchstack Security Vulnerability Report, the CSRF condition can be chained into stored Cross-Site Scripting (XSS), allowing attackers to persist malicious JavaScript in the WordPress site. The weakness is categorized under [CWE-352].

Critical Impact
An unauthenticated remote attacker can trick an authenticated administrator into submitting a forged request, leading to stored XSS execution within the WordPress admin context.

Affected Products

Genki Announcement WordPress plugin (genki-announcement) versions up to and including 1.4.1
WordPress sites with the plugin installed and active
Administrative users targeted via social engineering during an active session

Discovery Timeline

2025-01-16 - CVE-2025-23900 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-23900

Vulnerability Analysis

The Genki Announcement plugin processes state-changing administrative requests without verifying a valid anti-CSRF nonce or origin. An attacker hosts a malicious page or sends a crafted link to an authenticated WordPress administrator. When the administrator visits the page, the browser issues the forged request to the WordPress site using the active session cookie.

Because the plugin accepts the request without nonce validation, attacker-controlled input is stored in the plugin's announcement data. The stored payload subsequently renders in the WordPress admin or public interface, executing attacker-supplied JavaScript in the victim's browser context. This chain converts a CSRF primitive into persistent stored XSS, enabling session theft, privilege escalation paths, and further site compromise. The EPSS probability is 0.104%.

Root Cause

The root cause is missing CSRF protection on plugin handlers that accept user-supplied content. WordPress provides the wp_nonce_field() and check_admin_referer() APIs to bind requests to a verified session, but the affected handlers in versions through 1.4.1 do not enforce these checks. Combined with insufficient output encoding of the stored announcement content, the missing nonce verification permits a CSRF-to-stored-XSS chain.

Attack Vector

The attack requires user interaction from an authenticated WordPress administrator. The attacker crafts an HTML page containing an auto-submitting form or fetch request targeting the vulnerable plugin endpoint. When the administrator browses to the attacker-controlled page, their authenticated session executes the forged request. The injected payload persists in the plugin's data store and triggers on subsequent page renders.

No authentication or credentials are required from the attacker. The attack vector is network-based and exploits trust in the administrator's browser session. See the Patchstack advisory for additional technical context.

Detection Methods for CVE-2025-23900

Indicators of Compromise

Unexpected <script> tags, event handlers, or external JavaScript references stored in Genki Announcement plugin records
WordPress administrator sessions making POST requests to plugin endpoints originating from third-party referrers
New or modified announcement entries created outside of normal administrative workflows
Outbound requests from administrator browsers to unknown domains after viewing the WordPress dashboard

Detection Strategies

Inspect the WordPress database tables used by genki-announcement for HTML or JavaScript content that should not appear in plain-text announcements
Review web server access logs for POST requests to plugin admin endpoints with Referer headers pointing to external domains
Monitor browser-side Content Security Policy (CSP) violation reports for inline script execution on /wp-admin/ pages

Monitoring Recommendations

Enable WordPress audit logging to capture plugin setting changes and the user account responsible
Alert on administrator activity that occurs immediately after navigation from external referrers
Track installed plugin versions across managed WordPress sites and flag any instance of genki-announcement at version 1.4.1 or earlier

How to Mitigate CVE-2025-23900

Immediate Actions Required

Identify every WordPress site running the Genki Announcement plugin and confirm the installed version
Deactivate the plugin on any site running version 1.4.1 or earlier until a patched release is applied
Review stored announcement content and remove any unauthorized HTML or script payloads
Force a password reset and session invalidation for administrator accounts that may have been targeted

Patch Information

At the time of NVD publication, the advisory indicates the vulnerability affects Genki Announcement versions through <= 1.4.1. Site operators should consult the Patchstack vulnerability page and the WordPress plugin repository for the latest fixed release and upgrade to a version that implements wp_verify_nonce() checks on state-changing endpoints.

Workarounds

Restrict access to /wp-admin/ using IP allowlists or a web application firewall (WAF) rule set that enforces same-origin Referer validation
Deploy a CSP that disallows inline script execution in the WordPress admin interface to limit stored XSS impact
Require administrators to use separate browser profiles for WordPress administration to reduce CSRF exposure from general browsing

bash

# Example: locate vulnerable plugin installations across managed WordPress hosts
find /var/www -type d -name 'genki-announcement' -exec \
  grep -H '^Version:' {}/genki-announcement.php \;