CVE-2025-23537: 
WordPress vulnerability analysis and mitigation

Cross-Site Request Forgery (CSRF) vulnerability was discovered in the WordPress plugin 'add custom google tag manager' affecting versions up to 1.0.3. The vulnerability was disclosed on January 16, 2025, and was assigned CVE-2025-23537. This security issue allows for Stored Cross-Site Scripting (XSS) attacks through the plugin's functionality (Patchstack).

The vulnerability stems from missing or incorrect nonce validation on a function within the plugin. The issue has been assigned a CVSS v3.1 base score of 7.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery) (WPScan).

This vulnerability enables unauthenticated attackers to update settings and inject malicious web scripts via forged requests, provided they can trick a site administrator into performing specific actions such as clicking on a malicious link (WPScan).

Currently, there is no known fix available for this vulnerability. Users of the affected plugin versions (1.0.3 and below) should consider implementing additional security measures or potentially removing the plugin until a patch is released (WPScan).