CVE-2025-12590 describes a vulnerability in the YSlider WordPress plugin (versions up to and including 1.1) where missing nonce verification on the content configuration page combined with insufficient input sanitization and output escaping allows unauthenticated attackers to perform CSRF attacks that lead to stored XSS. The attacker must trick an administrator into triggering the forged request, which injects malicious scripts into pages. These scripts execute in the context of users visiting the infected pages, potentially leading to session hijacking or other client-side impacts. The CVSS 3.1 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, but requiring user interaction and resulting in limited confidentiality and integrity impact.

Successful exploitation allows an unauthenticated attacker to inject persistent malicious scripts into pages managed by the YSlider plugin, which execute in the browsers of users who visit those pages. This can lead to limited confidentiality and integrity impacts such as session hijacking or unauthorized actions performed by users. There is no direct impact on availability. The attack requires tricking an administrator into performing an action, such as clicking a link.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is indicated, users should avoid using vulnerable versions of the YSlider plugin or disable it until a fix is available. Administrators should be cautious about clicking untrusted links that could trigger CSRF attacks. Monitoring vendor channels for updates or patches is recommended.