CVE-2025-48104: Floating Window Music Player CSRF Flaw

CVE-2025-48104 Overview

CVE-2025-48104 is a Cross-Site Request Forgery (CSRF) vulnerability in the Floating Window Music Player WordPress plugin developed by ericzane. This vulnerability allows attackers to chain CSRF with Stored Cross-Site Scripting (XSS), enabling malicious actors to inject persistent scripts into the plugin's configuration by tricking authenticated administrators into performing unintended actions.

Critical Impact

Attackers can leverage this vulnerability to inject malicious JavaScript that persists in the WordPress database, potentially compromising site visitors, stealing administrator credentials, or performing unauthorized actions on behalf of authenticated users.

Affected Products

• Floating Window Music Player WordPress plugin version 3.4.2 and earlier
• WordPress installations with the floating-window-music-player plugin active

Discovery Timeline

• 2025-09-05 - CVE-2025-48104 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-48104

Vulnerability Analysis

This vulnerability combines two distinct attack vectors: Cross-Site Request Forgery (CSRF) and Stored Cross-Site Scripting (XSS). The Floating Window Music Player plugin fails to implement proper CSRF token validation on administrative actions, allowing attackers to craft malicious requests that execute when an authenticated administrator visits an attacker-controlled page.

The absence of nonce verification in the plugin's settings handling mechanism means that any state-changing request can be forged. When combined with insufficient input sanitization, attackers can inject JavaScript payloads that are stored in the WordPress database and executed whenever the affected page or administrative interface is rendered.

Root Cause

The root cause of CVE-2025-48104 is the lack of CSRF protection (nonce verification) on form submissions and AJAX handlers within the Floating Window Music Player plugin. WordPress provides built-in functions such as wp_nonce_field() and wp_verify_nonce() to protect against CSRF attacks, but the vulnerable versions of this plugin do not implement these security controls. Additionally, user-supplied input is not properly sanitized before being stored, enabling the Stored XSS component of this attack chain.

Attack Vector

An attacker exploits this vulnerability by crafting a malicious webpage or email containing a hidden form or JavaScript that automatically submits a request to the WordPress admin panel. When an authenticated administrator with sufficient privileges visits the attacker's page while logged into WordPress, the browser automatically includes their session cookies, causing the forged request to execute with administrative privileges.

The attack flow involves:

1. The attacker identifies the vulnerable plugin endpoint that accepts configuration changes without CSRF validation
2. A malicious page is crafted containing a form that targets the plugin's settings submission handler
3. The form payload includes JavaScript code embedded in a configuration field that lacks proper sanitization
4. When an administrator visits the malicious page, the form auto-submits, injecting the XSS payload
5. The stored script executes whenever the affected page is viewed, compromising subsequent visitors or administrators

For detailed technical information about this vulnerability, refer to the PatchStack Vulnerability Report.

Detection Methods for CVE-2025-48104

Indicators of Compromise

• Unexpected changes to Floating Window Music Player plugin settings
• JavaScript code present in plugin configuration fields that should only contain plain text or URLs
• Unusual <script> tags or event handlers (onclick, onerror, etc.) in the database wp_options table related to the plugin
• Browser console errors or unexpected redirects when accessing pages with the music player widget

Detection Strategies

• Review WordPress database entries for the Floating Window Music Player plugin settings for any embedded JavaScript or HTML tags
• Monitor HTTP access logs for POST requests to plugin admin endpoints originating from external referrers
• Implement Content Security Policy (CSP) headers to detect and block inline script execution attempts
• Use WordPress security plugins to scan for stored XSS payloads in the database

Monitoring Recommendations

• Enable detailed logging for WordPress admin actions and plugin configuration changes
• Set up alerts for configuration modifications to the floating-window-music-player plugin
• Monitor for unusual outbound network connections that may indicate data exfiltration from injected scripts
• Regularly audit plugin settings for unauthorized modifications

How to Mitigate CVE-2025-48104

Immediate Actions Required

• Update the Floating Window Music Player plugin to a patched version if available from the plugin developer
• Deactivate and remove the plugin if no patch is available and the functionality is not critical
• Review and clean any existing plugin configuration for injected scripts or malicious content
• Force logout all administrative sessions and reset passwords if compromise is suspected

Patch Information

Check the PatchStack Vulnerability Report for the latest patch status and remediation guidance. If no official patch is available, consider removing the plugin until the developer addresses the vulnerability.

Workarounds

• Implement a Web Application Firewall (WAF) rule to block suspicious POST requests to the plugin's admin endpoints from external referrers
• Restrict administrative access to trusted IP addresses only
• Use browser extensions like NoScript when performing administrative tasks to prevent auto-form submission attacks
• Consider replacing the plugin with an alternative music player plugin that follows WordPress security best practices

# Verify plugin version and consider deactivation
wp plugin list --name=floating-window-music-player --fields=name,version,status

# Deactivate vulnerable plugin
wp plugin deactivate floating-window-music-player

# Search database for potential XSS payloads
wp db query "SELECT * FROM wp_options WHERE option_name LIKE '%floating%music%' AND option_value LIKE '%<script%'"