The vulnerability CVE-2025-23640 affects the Rename Author Slug plugin (<= 1.2.0) by Nazmul Ahsan. It is a Cross-Site Request Forgery (CSRF) flaw that enables an attacker to execute stored Cross-Site Scripting (XSS) attacks by tricking an authenticated user into submitting a crafted request. The CVSS 3.1 base score is 7.1, reflecting network exploitability, low complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No patch or vendor advisory has been provided, and no known exploits are reported in the wild.

Successful exploitation can lead to stored XSS, allowing attackers to execute malicious scripts in the context of the victim's browser. This can result in data theft, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability of the affected system. The vulnerability requires user interaction but no privileges, making it a significant risk for users of the affected plugin versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the Rename Author Slug plugin if feasible, or apply any recommended temporary mitigations from the vendor. Monitor official channels for updates and patches.