Cross-Site Request Forgery Vulnerability in WP User Stylesheet Switcher by WordPress
CVE-2025-52792

7.1HIGH

Key Information:

Vendor

WordPress
Status
WP User Stylesheet Switcher
Vendor
CVE Published:
20 June 2025

What is CVE-2025-52792?

A Cross-Site Request Forgery (CSRF) vulnerability exists in the WP User Stylesheet Switcher plugin, which allows an attacker to perform actions on behalf of a user without their consent. This can lead to Stored Cross-Site Scripting (XSS) attacks, potentially compromising user data and security. The vulnerability affects WP User Stylesheet Switcher in all versions up to and including v2.2.0, making it crucial for users to apply the necessary updates and patches to safeguard their WordPress sites.

Affected Version(s)

WP User Stylesheet Switcher <= n/a

References

https://patchstack.com/database/wordpress/plugin/wp-user-...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Xuan Chien (Patchstack Alliance)
.
CVE-2025-52792 : Cross-Site Request Forgery Vulnerability in WP User Stylesheet Switcher by WordPress