CVE-2025-24555: 
WordPress vulnerability analysis and mitigation

Cross-Site Request Forgery (CSRF) vulnerability was discovered in SubscriptionDNA.com's Subscription DNA WordPress plugin versions through 2.1. The vulnerability was disclosed on January 24, 2025, and was assigned CVE-2025-24555. The issue allows attackers to perform Stored Cross-Site Scripting (XSS) attacks (NVD, Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 7.1 (High), with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The issue is classified under CWE-352 (Cross-Site Request Forgery). The vulnerability allows an attacker to execute unwanted actions under the authentication of higher privileged users (Patchstack).

The vulnerability combines CSRF with Stored XSS capabilities, potentially allowing attackers to execute malicious JavaScript code in the context of authenticated users' sessions. This could lead to unauthorized actions, data theft, and compromise of website functionality (Patchstack).

The vulnerability is exploitable remotely and requires no authentication (unauthenticated attack vector). However, it does require user interaction to complete the attack chain. The vulnerability was discovered by researcher SOPROBRO (Patchstack).

The vulnerability has been fixed in version 2.2 of the Subscription DNA plugin. Users are advised to update to this version or later to mitigate the security risk (Patchstack).