Cross-Site Request Forgery Vulnerability in Disqus Popular Posts by WordPress
CVE-2025-22705

7.1HIGH

Key Information:

Vendor
Godthor
Status
Disqus Popular Posts
Vendor
CVE Published:
14 February 2025

Summary

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Disqus Popular Posts plugin, affecting versions up to and including 2.1.1. This issue can lead to reflected Cross-Site Scripting (XSS), allowing attackers to exploit users' interactions with the plugin, potentially compromising sensitive information or accounts. Users running the affected versions are advised to update to the latest version to mitigate these risks.

Affected Version(s)

Disqus Popular Posts <= 2.1.1

References

https://patchstack.com/database/wordpress/plugin/disqus-p...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

stealthcopter (Patchstack Alliance)
.