CVE-2025-23980 - WordPress Full Circle plugin <= 0.5.7.8 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

Back Back to CVE browser

HIGH

WordPress Full Circle plugin <= 0.5.7.8 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

Published Jan 31, 2025

7.1

HIGH

CVSS 3.1

EPSS 0.13%

Description

Cross-Site Request Forgery (CSRF) vulnerability in James Andrews Full Circle full-circle allows Stored XSS.This issue affects Full Circle: from n/a through <= 0.5.7.8.

Affected products

Vendor James Andrews Product Full Circle Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=0.5.7.8

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

James Andrews

Full Circle

unaffected

Version	Status	Constraints
0	affected	<=0.5.7.8

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (1)

https://patchstack.com/database/Wordpress/Plugin/full-circle/vulnerability/wordpress-full-circle-plugin-0-5-7-8-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
vdb-entry

Link	Providers	Tags
https://patchstack.com/database/Wordpress/Plugin/full-circle/vulnerability/wordpress-full-circle-plugin-0-5-7-8-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve		vdb-entry

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Patchstack

Published Jan 31, 2025

Updated May 11, 2026

Reserved Jan 16, 2025

Link CVE-2025-23980

CISA Vulnrichment

Updated Jan 31, 2025

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2025-23980

Red Hat

Severity n/a

Public date n/a

Links CVE-2025-23980