CVE-2025-11992 affects the Multi Item Responsive Slider plugin for WordPress, where the lack of proper nonce validation on the 'mioptions.php' page enables Cross-Site Request Forgery attacks. An attacker can exploit this by tricking an administrator into clicking a malicious link, causing unauthorized changes to plugin settings and injection of malicious scripts, resulting in reflected or stored XSS. The vulnerability impacts confidentiality and integrity but does not affect availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity.

Successful exploitation allows an attacker to update plugin settings and inject malicious scripts via forged requests, potentially leading to unauthorized script execution in the context of the administrator's browser. This can compromise confidentiality and integrity of the affected site. There is no indication of availability impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking on untrusted links and consider disabling or removing the vulnerable plugin. Monitoring for updates from the plugin developer is recommended to apply any forthcoming patches promptly.