CVE-2025-46504: Vasaio QR Code CSRF Vulnerability

CVE-2025-46504 Overview

CVE-2025-46504 is a Cross-Site Request Forgery (CSRF) vulnerability in the Olar Marius Vasaio QR Code (vasaio-qr-code) WordPress plugin. The flaw affects all versions through 1.2.5 and enables Stored Cross-Site Scripting (XSS) when an authenticated administrator is tricked into submitting an attacker-controlled request. The weakness maps to [CWE-352] Cross-Site Request Forgery and stems from missing or insufficient anti-CSRF token validation on plugin actions that persist user-supplied input.

Critical Impact
Successful exploitation allows an unauthenticated attacker to plant persistent JavaScript in the WordPress admin context, leading to session theft, account takeover, and arbitrary actions performed as the targeted administrator.

Affected Products

Olar Marius Vasaio QR Code (vasaio-qr-code) WordPress plugin
All versions from n/a through 1.2.5
WordPress sites with the plugin installed and an authenticated administrator session

Discovery Timeline

2025-04-24 - CVE-2025-46504 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-46504

Vulnerability Analysis

The vulnerability chains two distinct web application weaknesses. The plugin exposes administrative actions that modify stored content without verifying a WordPress nonce or other anti-CSRF token. An attacker hosts a malicious page that issues a forged request to the vulnerable endpoint. When an authenticated administrator visits the page, the browser submits the request with valid session cookies.

The forged request injects attacker-controlled HTML or JavaScript into a plugin-managed field. The plugin stores the payload and renders it later without adequate output encoding. The result is Stored XSS executed in the context of any user who loads the affected admin or front-end page.

The scope-changed CVSS vector indicates that exploitation impacts resources beyond the vulnerable component. User interaction is required because the administrator must visit the attacker's page while logged in.

Root Cause

The root cause is the absence of CSRF protection on plugin write operations. WordPress provides wp_nonce_field() and check_admin_referer() for this purpose, but the affected handlers do not validate a nonce before persisting input. A secondary defect is insufficient sanitization and escaping of stored data, which allows the injected script to execute when rendered.

Attack Vector

The attack vector is network-based and requires social engineering. An attacker crafts a web page containing an auto-submitting form or fetch request targeting the vulnerable plugin endpoint on the victim's WordPress site. The attacker lures a logged-in administrator to the page through phishing, a forum link, or a malicious advertisement. The browser submits the request with the administrator's cookies, the plugin accepts it, and the XSS payload is stored.

No authentication credentials are needed by the attacker; the victim's authenticated session performs the privileged action. See the Patchstack Vulnerability Report for additional technical detail.

Detection Methods for CVE-2025-46504

Indicators of Compromise

Unexpected <script>, onerror, or onload content in Vasaio QR Code plugin records or related WordPress options
Administrator HTTP requests to plugin endpoints originating from Referer headers on third-party domains
New or unfamiliar administrator accounts, modified user roles, or unexpected outbound requests from admin browser sessions
WordPress audit log entries showing plugin configuration changes that do not correspond to legitimate administrator activity

Detection Strategies

Inspect the WordPress database for stored plugin fields containing HTML event handlers or <script> tags
Review web server access logs for POST requests to vasaio-qr-code admin handlers with off-site Referer values
Deploy a Web Application Firewall rule that flags state-changing requests to the plugin lacking a valid _wpnonce parameter
Monitor browser-side telemetry for script execution sourced from administrator-only pages

Monitoring Recommendations

Enable WordPress activity logging plugins that record option and post meta changes attributable to specific users
Alert on anomalous administrator session activity such as off-hours configuration changes or rapid sequential edits
Forward web server and WordPress logs to a centralized SIEM for correlation with phishing and proxy telemetry

How to Mitigate CVE-2025-46504

Immediate Actions Required

Deactivate and remove the Vasaio QR Code plugin until a fixed version is confirmed available
Audit stored plugin data and remove any injected scripts or HTML event handlers
Force a password reset and session invalidation for all WordPress administrator accounts
Review recently added users, plugins, and theme files for signs of post-exploitation persistence

Patch Information

No fixed version is published in the source data. The vulnerability affects all releases through 1.2.5. Monitor the plugin page and the Patchstack Vulnerability Report for an updated release, and apply it as soon as it becomes available.

Workarounds

Remove the plugin if QR code functionality is non-essential
Restrict access to /wp-admin/ by source IP using web server or WAF rules
Require administrators to use a dedicated browser profile for WordPress management to limit cross-site request exposure
Deploy a Content Security Policy that blocks inline script execution in the WordPress admin context

bash

# Example: restrict WordPress admin access by IP using Apache .htaccess
<Files "admin-ajax.php">
    Require all denied
    Require ip 203.0.113.10
</Files>

<Directory "/var/www/html/wp-admin">
    Require all denied
    Require ip 203.0.113.0/24
</Directory>