CVE-2025-31460
Published: 28 March 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-31460 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the WordPress plugin OmniLeads Scripts and Tags Manager (omnileads-scripts-and-tags-manager) by danielmuldernl. The flaw allows Stored XSS and affects all versions from n/a through 1.3 inclusive. It was published on 2025-03-28 with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Unauthenticated attackers can exploit this vulnerability over the network with low attack complexity by tricking authenticated users into performing actions via malicious requests that require user interaction. Successful exploitation enables Stored XSS, resulting in low impacts to confidentiality, integrity, and availability, with a changed scope.
The Patchstack advisory provides details on this WordPress plugin vulnerability at https://patchstack.com/database/Wordpress/Plugin/omnileads-scripts-and-tags-manager/vulnerability/wordpress-omnileads-scripts-and-tags-manager-plugin-1-3-csrf-to-stored-xss-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
CSRF-to-Stored-XSS vulnerability in public-facing WordPress plugin directly enables exploitation of a public-facing application (T1190) to inject and execute malicious client-side scripts.