CVE-2025-25075: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the WordPress plugin 'Show notice or message on admin area' affecting versions up to and including 2.0. The vulnerability was disclosed on February 3, 2025, and was assigned CVE-2025-25075. The issue stems from missing or incorrect nonce validation on a function within the plugin (WPScan, Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 7.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The issue is classified under CWE-352 (Cross-Site Request Forgery). The vulnerability allows for a CSRF attack that can lead to stored Cross-Site Scripting (XSS) (NVD, Patchstack).

The vulnerability enables unauthenticated attackers to update settings and inject malicious web scripts through forged requests, provided they can deceive a site administrator into performing specific actions such as clicking on a malicious link (WPScan).

Currently, there is no official fix available for this vulnerability. The issue affects all versions up to and including version 2.0 of the Show notice or message on admin area plugin (Patchstack).