CVE-2022-25608: 
WordPress vulnerability analysis and mitigation

Cross-Site Request Forgery (CSRF) vulnerability was discovered in the WordPress Yoo Slider – Image Slider & Video Slider plugin versions up to 2.0.0. The vulnerability was disclosed on March 21, 2022, and assigned CVE-2022-25608. This security flaw affects the slider management functionality of the plugin (Patchstack Advisory).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) and received a CVSS v3.1 base score of 5.4 (Medium). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) but user interaction (UI:R). The scope is unchanged (S:U) with low impacts on integrity and availability (I:L, A:L) and no impact on confidentiality (C:N) (NVD).

The vulnerability allows attackers to trick authenticated users into performing unwanted slider duplicate or delete actions without their knowledge or consent. This could lead to unauthorized manipulation of slider content on the affected WordPress sites (Patchstack Advisory).

The vulnerability was patched in version 2.1.0 of the Yoo Slider plugin. Users are advised to update to version 2.1.0 or later to resolve the security issue (Patchstack Advisory).