CVE-2025-6054 is a CSRF vulnerability in the stratosg YANewsflash WordPress plugin affecting all versions up to 1.0.3. The issue arises from missing or incorrect nonce validation on the 'yanewsflash/yanewsflash.php' page, which enables attackers to craft forged requests that, when executed by an authenticated site administrator, can update plugin settings or inject malicious web scripts. The vulnerability requires user interaction (UI:R) and has network attack vector (AV:N), no privileges required (PR:N), and impacts confidentiality and integrity with a scope change (S:C).

Successful exploitation can lead to unauthorized changes to plugin settings and injection of malicious scripts, potentially compromising site integrity and confidentiality. The attack requires tricking an authenticated administrator into performing an action, so exploitation depends on social engineering. There is no indication of availability impact. No known exploits have been reported.

Patch status is not yet confirmed — no official fix or update is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a patch is released, administrators should exercise caution when interacting with untrusted links or requests that could trigger plugin actions. Implementing additional CSRF protections at the site level or restricting administrative access may help reduce risk.