Cyber Posture

CVE-2025-31460

High

Published: 28 March 2025

Published
28 March 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0008 23.4th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-31460 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the WordPress plugin OmniLeads Scripts and Tags Manager (omnileads-scripts-and-tags-manager) by danielmuldernl. The flaw allows Stored XSS and affects all versions from n/a through 1.3 inclusive. It was published on 2025-03-28 with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

Unauthenticated attackers can exploit this vulnerability over the network with low attack complexity by tricking authenticated users into performing actions via malicious requests that require user interaction. Successful exploitation enables Stored XSS, resulting in low impacts to confidentiality, integrity, and availability, with a changed scope.

The Patchstack advisory provides details on this WordPress plugin vulnerability at https://patchstack.com/database/Wordpress/Plugin/omnileads-scripts-and-tags-manager/vulnerability/wordpress-omnileads-scripts-and-tags-manager-plugin-1-3-csrf-to-stored-xss-vulnerability?_s_id=cve.

Details

CWE(s)
CWE-352

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

CSRF-to-Stored-XSS vulnerability in public-facing WordPress plugin directly enables exploitation of a public-facing application (T1190) to inject and execute malicious client-side scripts.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References