Atakan Au Import CDN-Remote Images CVE-2025-48153

This vulnerability combines two attack classes: CWE-352 (Cross-Site Request Forgery) and stored XSS. The root cause is insufficient CSRF token validation in the Import CDN-Remote Images WordPress plugin, which allows an attacker to forge requests on behalf of authenticated administrators. When a CSRF protection is missing or improperly implemented, an attacker can craft HTML or JavaScript on an external site that, when visited by a logged-in WordPress administrator, executes requests against the vulnerable plugin without the administrator's knowledge. The forged request can modify plugin settings or inject malicious content that gets stored in the WordPress database, resulting in persistent XSS that executes in the browsers of all site visitors. The plugin processes remote image imports, making it a vector for injecting malicious payloads into supposedly legitimate image metadata or import configurations.