Cross-Site Request Forgery in Mark Barnes Style Tweaker Affects WordPress
CVE-2025-25160

7.1HIGH

Key Information:

Vendor

WordPress
Status
Style Tweaker
Vendor
CVE Published:
7 February 2025

What is CVE-2025-25160?

A Cross-Site Request Forgery (CSRF) vulnerability in the Mark Barnes Style Tweaker plugin for WordPress enables attackers to conduct unauthorized actions on behalf of users. This vulnerability can lead to Stored Cross-Site Scripting (XSS) attacks, allowing malicious scripts to be executed in a victim's browser, compromising sensitive data and user session security. The affected versions range from n/a through 0.11, making it crucial for WordPress site administrators to update or patch the plugin to mitigate these risks.

Affected Version(s)

Style Tweaker 0 <= 0.11

References

https://patchstack.com/database/Wordpress/Plugin/style-tw...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abdi Pranata (Patchstack Alliance)
.