CVE-2025-25100: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in victoracano Cazamba WordPress plugin through version 1.2. The vulnerability allows attackers to perform reflected Cross-Site Scripting (XSS) attacks. This security issue was disclosed on March 27, 2025 (NVD).

The vulnerability has been assigned CVE-2025-25100 and received a CVSS v3.1 Base Score of 7.1 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery) and allows attackers to execute reflected XSS attacks through CSRF (NVD, Patchstack).

The vulnerability affects confidentiality, integrity, and availability of the system, each with a Low impact rating as indicated by the CVSS score. The cross-site request forgery can lead to reflected XSS attacks, potentially allowing attackers to execute malicious scripts in users' browsers (NVD).

The vulnerability requires no privileges for exploitation but does need user interaction. It can be accessed through the network with low attack complexity, as indicated by the CVSS metrics (AV:N/AC:L/PR:N/UI:R) (NVD).

Users should upgrade from affected versions (through 1.2) to a patched version when available. As this is a CSRF vulnerability, implementing proper CSRF tokens and validating requests can help mitigate the risk (NVD).