CVE-2025-9883

Vulnerability

Overview

The Browser Sniff plugin for WordPress, in all versions up to and including 2.3, lacks proper nonce validation on a function that handles plugin settings. This absence of a CSRF token check allows an unauthenticated attacker to forge requests that modify the plugin's configuration.

Exploitation

To exploit this vulnerability, an attacker must trick a logged-in site administrator into performing an action, such as clicking a specially crafted link. The forged request can then update arbitrary plugin settings without the administrator's awareness.

Impact

Successful exploitation enables the attacker to inject malicious web scripts into the plugin's settings. These scripts can be stored and executed in the context of the administrator's session, leading to stored cross-site scripting (XSS) attacks that may affect other users or compromise the site.

Mitigation

Status

The plugin has been closed as of September 17, 2025, and is no longer available for download [1]. No official patch exists for this vulnerability, and administrators are strongly advised to remove the plugin from their WordPress installations.