Cross-Site Request Forgery Vulnerability in theMarketer Plugin by WordPress
CVE-2025-47655

7.1HIGH

Key Information:

Vendor

WordPress
Status
Themarketer
Vendor
CVE Published:
7 May 2025

What is CVE-2025-47655?

The theMarketer plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability that can be exploited to perform unauthorized actions. This weakness can lead to Stored Cross-Site Scripting (XSS), allowing attackers to inject malicious scripts that may compromise user data and security. Affected versions include theMarketer up to 1.4.7. It is crucial for users to update their plugins promptly to safeguard against potential exploits.

Affected Version(s)

theMarketer <= 1.4.7

References

https://patchstack.com/database/wordpress/plugin/themarke...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Xuan Chien (Patchstack Alliance)
.