CVE-2025-23805 HIGH

CVE-2025-23805: WordPress SEOReseller Partner plugin <= 1.3.15 - CSRF to Stored XSS vulnerability

Vendor Itamarg
Product SEOReseller Partner
Weakness CWE-352 · CSRF
Published January 16, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in itamarg SEOReseller Partner sr-partner allows Cross Site Request Forgery.This issue affects SEOReseller Partner: from n/a through <= 1.3.15.

Explanation of Vulnerability in Simple Terms

02Summary

SEOReseller Partner versions up to 1.3.15 are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the site without their knowledge. The vulnerability requires user interaction—the admin must visit the attacker's page while authenticated. Impact is limited to low-level data exposure and modification.

What an attacker can do

03Attacker Capabilities

Trick a logged-in admin into performing unwanted actions on the site by visiting a malicious webpage.

Potential impact on your site

04Site Impact

Administrators could unknowingly modify site settings or data if tricked into visiting a malicious link while logged in.

Conditions required to exploit

05Prerequisites

Admin must be logged in and visit an attacker-controlled webpage; no special privileges required.

Key dates

06Disclosure timeline

January 16, 2025 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-63265 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints CVE-2026-57751 WordPress Heateor Social Login plugin <= 1.1.39 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-63280 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs conditions manager CVE-2026-15212 WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 43.2 - Cross-Site Request Forgery to Privilege Escalation via Plugin Settings Update CVE-2026-57785 WordPress ApusListing theme <= 1.2.63 - Cross Site Request Forgery (CSRF) vulnerability