CVE-2025-52792: WP User Stylesheet Switcher CSRF Vulnerability

CVE-2025-52792 Overview

CVE-2025-52792 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP User Stylesheet Switcher WordPress plugin developed by vgstef. The flaw affects all versions up to and including v2.2.0. An attacker can leverage the CSRF weakness to deliver Stored Cross-Site Scripting (XSS) payloads, allowing persistent injection of malicious script into the plugin's stored configuration. The issue is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
Successful exploitation requires an authenticated user to visit an attacker-controlled page, after which malicious JavaScript is persistently stored and executed in the WordPress site context.

Affected Products

WP User Stylesheet Switcher plugin (wp-user-stylesheet-switcher) versions up to and including v2.2.0
WordPress installations with the vulnerable plugin enabled
No fixed version is identified in the available advisory data

Discovery Timeline

2025-06-20 - CVE-2025-52792 published to the National Vulnerability Database
2026-04-23 - Last updated in NVD

Technical Details for CVE-2025-52792

Vulnerability Analysis

The WP User Stylesheet Switcher plugin exposes administrative actions that change persisted plugin state without verifying request authenticity. Because state-changing endpoints lack a valid anti-CSRF nonce check, an attacker can forge requests on behalf of an authenticated administrator. The forged request stores attacker-supplied input that is later rendered in the WordPress interface without proper output encoding, producing Stored XSS.

The combination of CSRF and Stored XSS expands the impact beyond a single victim. Once the payload is persisted, every user who loads the affected page executes the injected script in their browser. This can enable session theft, administrative action hijacking, and lateral compromise of the WordPress instance.

Exploitation requires user interaction, as defined by the UI:R component of the CVSS vector. The scope is changed because the injected script runs in the WordPress origin and affects users beyond the initially targeted administrator.

Root Cause

The root cause is missing or inadequate CSRF protection on plugin endpoints that accept and store user-controlled input. WordPress plugins are expected to validate requests with wp_nonce_field() and check_admin_referer() or wp_verify_nonce(). The absence of these checks allows an off-site form to submit state-changing requests that the WordPress instance trusts based solely on the victim's authenticated session cookie. Compounding the issue, the stored values are output without sanitization through esc_html() or esc_attr().

Attack Vector

An attacker hosts a malicious page containing a crafted form or JavaScript that targets the vulnerable plugin endpoint. The attacker lures a logged-in WordPress administrator to visit the page through phishing or a watering hole. The browser submits the forged request with the victim's session cookies, and the plugin persists the attacker's XSS payload. Subsequent visits to the affected admin or front-end view trigger script execution in the victim's browser. See the Patchstack WordPress Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2025-52792

Indicators of Compromise

Unexpected <script> tags, onerror, or onload attributes stored in WP User Stylesheet Switcher configuration entries or stylesheet metadata
WordPress administrator referrers in access logs originating from external domains immediately preceding plugin setting changes
New or modified plugin options containing encoded JavaScript payloads such as javascript: URIs or base64-encoded script blocks
Outbound requests from administrator browsers to unknown domains after visiting plugin admin pages

Detection Strategies

Review the wp_options table and plugin-specific options for any values containing HTML or script content where styling identifiers are expected
Audit WordPress access logs for POST requests to wp-admin/admin.php or admin-post.php targeting the plugin without a matching Referer from the same origin
Use WordPress security scanners that inspect installed plugins against the Patchstack and WPScan vulnerability databases

Monitoring Recommendations

Enable WordPress audit logging to capture plugin setting changes, including the acting user, source IP, and request headers
Alert on responses to administrative endpoints that include script-bearing payloads in stored fields
Monitor administrator sessions for anomalous activity following access to external URLs in close temporal proximity to plugin configuration changes

How to Mitigate CVE-2025-52792

Immediate Actions Required

Deactivate and remove the WP User Stylesheet Switcher plugin if a patched version is not available for your installation
Audit existing plugin settings for stored XSS payloads and remove any unauthorized script content
Force a password reset and session invalidation for all administrator accounts that may have been targeted
Restrict administrator browsing to trusted sites and require separate accounts for content authoring versus administrative tasks

Patch Information

No fixed version is identified in the referenced advisory data. Monitor the Patchstack advisory and the official WordPress plugin repository for an updated release that adds nonce verification and output escaping.

Workarounds

Deploy a Web Application Firewall (WAF) rule that blocks POST requests to the plugin's admin endpoints lacking a same-origin Referer and valid _wpnonce parameter
Restrict access to /wp-admin/ by source IP using server configuration or a reverse proxy
Apply Content Security Policy (CSP) headers such as Content-Security-Policy: script-src 'self' to reduce the impact of stored XSS execution
Require re-authentication for administrative actions through plugins that enforce step-up authentication

bash

# Example nginx configuration restricting wp-admin to a trusted IP range
location ^~ /wp-admin/ {
    allow 203.0.113.0/24;
    deny all;
    try_files $uri $uri/ /index.php?$args;
}