Cross-Site Request Forgery Vulnerability in Wow-Company's Button Generator Plugin
CVE-2025-24713

5.4MEDIUM

Key Information:

Vendor
WordPress
Status
Button Generator – Easily Button Builder
Vendor
CVE Published:
24 January 2025

Summary

The Button Generator – easily Button Builder plugin by Wow-Company is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability. This flaw allows attackers to deceive users into executing unintended actions on the website without their consent. The vulnerability impacts versions up to and including 3.1.1, potentially compromising the security of the plugin and its users.

Affected Version(s)

Button Generator – easily Button Builder <= 3.1.1

References

https://patchstack.com/database/wordpress/plugin/button-g...
vdb-entry

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Khang Duong (Patchstack Alliance)
.