Cross-Site Request Forgery Vulnerability in CSS3 Accordions for WordPress by QuanticaLabs
CVE-2025-31922

7.1HIGH

Key Information:

Vendor

WordPress
Status
Css3 Accordions For WordPress
Vendor
CVE Published:
16 May 2025

What is CVE-2025-31922?

An identified Cross-Site Request Forgery (CSRF) vulnerability in QuanticaLabs' CSS3 Accordions for WordPress allows attackers to execute malicious requests on behalf of authenticated users. This issue can lead to stored Cross-Site Scripting (XSS) vulnerabilities, where an attacker may embed harmful scripts into the application. Users running versions of CSS3 Accordions from n/a up to 3.0 are particularly at risk, potentially compromising the security of their WordPress sites. It is crucial for website administrators to update to a secured version to mitigate such risks.

Affected Version(s)

CSS3 Accordions for WordPress <= 3.0

References

https://patchstack.com/database/wordpress/plugin/css3_acc...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) (Patchstack Alliance)
.