CSRF Vulnerability in Custom Links On Admin Dashboard Toolbar by Victor Barkalov
CVE-2025-25135

7.1HIGH

Key Information:

Vendor

WordPress
Status
Custom Links On Admin Dashboard Toolbar
Vendor
CVE Published:
7 February 2025

What is CVE-2025-25135?

A Cross-Site Request Forgery vulnerability in the Custom Links On Admin Dashboard Toolbar plugin by Victor Barkalov can lead to potential Stored XSS attacks. Affected versions range from unspecified until 3.3. This flaw allows an attacker to trick an authenticated administrator into executing unwanted actions on the site, which could compromise the security and integrity of the WordPress installation.

Affected Version(s)

Custom Links On Admin Dashboard Toolbar 0 <= 3.3

References

https://patchstack.com/database/Wordpress/Plugin/customiz...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abdi Pranata (Patchstack Alliance)
.