CVE-2025-46435: 
WordPress vulnerability analysis and mitigation

Cross-Site Request Forgery (CSRF) vulnerability was discovered in Yash Binani Time Based Greeting WordPress plugin, affecting versions through 2.2.2. The vulnerability was disclosed on April 24, 2025, and assigned identifier CVE-2025-46435. This security issue allows for Stored Cross-Site Scripting (XSS) attacks through CSRF (NVD, Patchstack).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.1 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery) and allows unauthenticated attackers to perform unauthorized actions through CSRF that can lead to stored XSS attacks (Patchstack).

The vulnerability enables attackers to force higher privileged users to execute unwanted actions under their current authentication, potentially leading to stored XSS attacks. This could result in compromised website security and unauthorized content modifications (Patchstack).

As of the disclosure date, no official fix is available for this vulnerability. The issue affects all versions through 2.2.2, and users are advised to consider alternative solutions or implement additional security measures (Patchstack).