First published: Thu Jan 16 2025(Updated: )
Cross-Site Request Forgery (CSRF) vulnerability in Gordon French Comment-Emailer allows Stored XSS.This issue affects Comment-Emailer: from n/a through 1.0.5.
Credit: audit@patchstack.com
Affected Software | Affected Version | How to fix |
---|---|---|
Gordon French Comment-Emailer | <=1.0.5 | |
WordPress Comment-Emailer | <=1.0.5 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2025-23627 is classified as a high-severity vulnerability due to its potential for exploitation via Cross-Site Request Forgery leading to Stored XSS.
To fix CVE-2025-23627, you should update the Comment-Emailer plugin to the latest version beyond 1.0.5.
CVE-2025-23627 affects the Comment-Emailer plugin for both Gordon French and WordPress up to version 1.0.5.
CVE-2025-23627 enables Cross-Site Request Forgery (CSRF) attacks that can lead to Stored Cross-Site Scripting (XSS).
Currently, the recommended approach to mitigate CVE-2025-23627 is to update the affected software, as no specific workaround is provided.