CSRF and XSS Vulnerability in UCRM Client Signup Plugin by Ubiquiti

CVE-2025-24289

What is CVE-2025-24289?

The UCRM Client Signup Plugin contains a Cross-Site Request Forgery (CSRF) vulnerability that can lead to Cross-Site Scripting (XSS). This flaw allows an attacker to potentially perform actions as an Administrator by tricking them into visiting a maliciously crafted webpage. As the plugin is disabled by default, users should be aware of this risk, particularly in scenarios where the plugin might be activated, making it imperative to ensure that proper security measures are in place.

References