CVE-2025-9883: 
WordPress vulnerability analysis and mitigation

The Browser Sniff plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to, and including, 2.3. The vulnerability was discovered and disclosed on September 19, 2025, with a CVSS v3 Base Score of 6.1 (Medium) (AttackerKB, Wordfence).

The vulnerability stems from missing or incorrect nonce validation on a function in the Browser Sniff WordPress plugin. This security flaw allows unauthenticated attackers to update settings and inject malicious web scripts through forged requests, provided they can trick a site administrator into performing specific actions such as clicking on a malicious link (AttackerKB).

If successfully exploited, attackers can manipulate plugin settings and inject malicious web scripts that will execute whenever users access the affected pages. This could lead to various attacks including data theft, session hijacking, or other malicious activities performed in the context of the victim's browser (AttackerKB).

The plugin has been temporarily closed as of September 17, 2025, pending a full security review. Site administrators should consider disabling or removing the Browser Sniff plugin until a patched version is available (WordPress Plugin).