CVE-2025-39547: Internal Link Optimiser CSRF Vulnerability

CVE-2025-39547 Overview

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Toast Plugins Internal Link Optimiser WordPress plugin that enables attackers to perform Stored Cross-Site Scripting (XSS) attacks. This chained vulnerability allows malicious actors to trick authenticated administrators into executing unintended actions, ultimately leading to the injection of persistent malicious scripts within the WordPress environment.

Critical Impact

This CSRF-to-XSS chain vulnerability can allow attackers to compromise WordPress administrator sessions, inject persistent malicious scripts, steal sensitive data, and potentially take complete control of affected WordPress installations.

Affected Products

• Toast Plugins Internal Link Optimiser versions up to and including 5.1.3
• WordPress installations running the vulnerable internal-link-finder plugin
• All users with administrative access to affected WordPress sites

Discovery Timeline

• 2025-04-16 - CVE-2025-39547 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-39547

Vulnerability Analysis

This vulnerability represents a chained attack combining Cross-Site Request Forgery (CSRF) with Stored Cross-Site Scripting (XSS). The Internal Link Optimiser plugin fails to implement proper CSRF token validation on critical administrative functions, allowing attackers to craft malicious requests that authenticated administrators may unknowingly execute.

The absence of CSRF protection creates a pathway for attackers to inject malicious JavaScript payloads that are then stored persistently within the WordPress database. When administrators or other users subsequently view pages containing the injected content, the malicious scripts execute within their browser context, potentially leading to session hijacking, privilege escalation, or further compromise of the WordPress installation.

Root Cause

The root cause of this vulnerability lies in the plugin's failure to implement anti-CSRF tokens (nonces) on forms and AJAX endpoints that handle user-supplied input. Without proper nonce verification, the plugin cannot distinguish between legitimate administrative requests and forged requests initiated by malicious third-party websites. Additionally, the plugin lacks adequate input sanitization and output encoding, enabling the injection of persistent XSS payloads.

Attack Vector

An attacker can exploit this vulnerability by crafting a malicious webpage containing a hidden form or JavaScript that automatically submits requests to the vulnerable plugin endpoints. When an authenticated WordPress administrator visits the attacker's page while logged into their WordPress site, the malicious request is executed with the administrator's privileges.

The attack flow proceeds as follows: The attacker identifies a vulnerable endpoint in the Internal Link Optimiser plugin that accepts user input without CSRF validation. They create a malicious page that submits a crafted request containing XSS payloads. When an administrator visits this page, the request is submitted automatically, storing the malicious script in the WordPress database. Subsequently, when any user views the affected content, the stored XSS payload executes in their browser.

For detailed technical analysis and proof-of-concept information, refer to the Patchstack Vulnerability Advisory.

Detection Methods for CVE-2025-39547

Indicators of Compromise

• Unexpected JavaScript code appearing in plugin settings or stored data
• Suspicious outbound requests from administrator browsers to unknown domains
• Unauthorized modifications to Internal Link Optimiser plugin configuration
• Evidence of session tokens or cookies being exfiltrated to external endpoints

Detection Strategies

• Monitor WordPress database for unexpected HTML/JavaScript content in plugin-related tables
• Implement Content Security Policy (CSP) headers to detect and block unauthorized script execution
• Review server access logs for suspicious POST requests to plugin endpoints without valid referrer headers
• Deploy web application firewalls (WAF) with rules to detect CSRF and XSS attack patterns

Monitoring Recommendations

• Enable WordPress audit logging to track administrative actions and configuration changes
• Configure alerting for unusual plugin setting modifications outside of maintenance windows
• Monitor browser console logs in administrative sessions for script execution errors indicating blocked XSS attempts
• Implement network-level monitoring for data exfiltration patterns from WordPress admin interfaces

How to Mitigate CVE-2025-39547

Immediate Actions Required

• Update the Internal Link Optimiser plugin to the latest patched version immediately
• Audit existing plugin data and settings for evidence of injected malicious content
• Force password resets for all WordPress administrator accounts as a precautionary measure
• Review and revoke any suspicious active sessions in WordPress

Patch Information

Users should update the Internal Link Optimiser plugin (internal-link-finder) to a version newer than 5.1.3 that addresses this CSRF vulnerability. Monitor the plugin's official WordPress repository or the vendor's website for security updates. For specific patch details and version information, consult the Patchstack Vulnerability Advisory.

Workarounds

• Temporarily deactivate the Internal Link Optimiser plugin until a patched version is available
• Implement a Web Application Firewall (WAF) with CSRF and XSS protection rules
• Restrict administrative access to trusted IP addresses only
• Enable browser-based XSS protection by implementing strict Content Security Policy headers

# WordPress wp-config.php - Add security headers via PHP
# Add the following to your theme's functions.php or a security plugin

# Example: Add security headers in .htaccess for Apache
<IfModule mod_headers.c>
    Header set X-XSS-Protection "1; mode=block"
    Header set X-Content-Type-Options "nosniff"
    Header set Content-Security-Policy "script-src 'self'"
    Header set X-Frame-Options "SAMEORIGIN"
</IfModule>