CSRF Vulnerability in Related Posts Widget with Thumbnails by WordPress
CVE-2025-31570

7.1HIGH

Key Information:

Vendor

WordPress
Status
Related Posts Widget With Thumbnails
Vendor
CVE Published:
31 March 2025

What is CVE-2025-31570?

A significant Cross-Site Request Forgery (CSRF) vulnerability exists in the Related Posts Widget with Thumbnails plugin for WordPress. This flaw can lead to Stored Cross-Site Scripting (XSS) attacks, allowing malicious actors to inject harmful scripts into the website. The vulnerability affects all versions from n/a up to and including 1.2, making it crucial for WordPress users to update and secure their installations to mitigate the risks associated with this potential exploit.

Affected Version(s)

Related Posts Widget with Thumbnails <= 1.2

References

https://patchstack.com/database/wordpress/plugin/advanced...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abdi Pranata (Patchstack Alliance)
.