CVE-2025-46442: 
WordPress vulnerability analysis and mitigation

Cross-Site Request Forgery (CSRF) vulnerability was discovered in Casey Johnson Loan Calculator plugin versions through 1.3. The vulnerability was assigned CVE-2025-46442 and was disclosed on April 24, 2025. This security issue affects the Loan Calculator WordPress plugin and allows attackers to perform Stored Cross-Site Scripting attacks (Patchstack, NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.1 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The issue is classified under CWE-352 (Cross-Site Request Forgery) and allows unauthenticated attackers to execute unwanted actions under the context of authenticated users (Patchstack).

The vulnerability combines CSRF with Stored XSS capabilities, allowing attackers to force higher privileged users to execute unwanted actions under their current authentication. This could potentially lead to stored cross-site scripting attacks, compromising the security of the website and its users (Patchstack).

The vulnerability requires no authentication to exploit and has been classified with low attack complexity. The attack vector is network-based (AV:N) and requires user interaction (UI:R) for successful exploitation (Patchstack).

As of the disclosure date, no official fix has been released for this vulnerability. The issue affects all versions through 1.3 of the Loan Calculator plugin (Patchstack).