CVE-2025-2163 identifies a Cross-Site Request Forgery vulnerability in the Zoorum Comments plugin for WordPress, specifically in the zoorum_set_options() function where nonce validation is missing or incorrect. This flaw enables unauthenticated attackers to craft forged requests that, if executed by a site administrator, can update plugin settings and inject malicious web scripts, resulting in Cross-Site Scripting (CWE-79). The vulnerability affects all versions up to and including 0.9. The CVSS 3.1 vector indicates network attack vector, no privileges required, user interaction required, and a scope change with limited confidentiality and integrity impacts but no availability impact.

Successful exploitation allows an attacker to perform unauthorized changes to plugin settings and inject malicious scripts via a forged request that requires an administrator to interact (e.g., click a link). This can lead to limited confidentiality and integrity impacts on the affected WordPress site, such as script execution in the context of the administrator's browser. There are no known exploits in the wild at this time.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, administrators should avoid clicking on untrusted links and consider disabling or removing the Zoorum Comments plugin if possible. Monitoring for updates from the vendor is recommended to apply an official fix once available.