Cross-Site Request Forgery Vulnerability in Themefy Bloggie Plugin for WordPress
CVE-2025-31054

7.1HIGH

Key Information:

Vendor

WordPress
Status
Bloggie
Vendor
CVE Published:
31 December 2025

What is CVE-2025-31054?

A Cross-Site Request Forgery (CSRF) vulnerability in the Themefy Bloggie plugin for WordPress enables attackers to execute malicious actions on behalf of users. This issue affects versions from n/a to 2.0.8, allowing for the possibility of reflected Cross-Site Scripting (XSS), which can lead to unauthorized access and manipulation of web content. It is crucial for website administrators to update their plugins to the latest versions to mitigate the risks associated with this vulnerability.

Affected Version(s)

Bloggie <= 2.0.8

References

https://vdp.patchstack.com/database/wordpress/theme/blogg...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) | Patchstack Bug Bounty Program
JSON
.
CVE-2025-31054 : Cross-Site Request Forgery Vulnerability in Themefy Bloggie Plugin for WordPress