CVE-2025-7685 is a Cross-Site Request Forgery vulnerability affecting the Like & Share My Site WordPress plugin (versions up to 0.2). The issue arises from missing or incorrect nonce validation on the 'lsms_admin' page, enabling attackers to forge requests that can update plugin settings or inject malicious web scripts if a site administrator is tricked into clicking a crafted link. The vulnerability has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability. There is no vendor advisory or patch information available at this time.

An attacker can exploit this vulnerability to perform unauthorized changes to plugin settings and inject malicious scripts by tricking an administrator into interacting with a crafted request. This can lead to partial compromise of site integrity and confidentiality. The vulnerability does not affect availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution when interacting with unsolicited links and consider restricting administrative access or using additional security plugins that provide CSRF protection.