Cross-Site Request Forgery in Clickbank WordPress Plugin by Dactum
CVE-2025-48353

7.1HIGH

Key Information:

Vendor

WordPress
Status
Clickbank WordPress Plugin (niche Storefront)
Vendor
CVE Published:
28 August 2025

What is CVE-2025-48353?

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Clickbank WordPress Plugin (Niche Storefront) crafted by Dactum, allowing attackers to execute unauthorized actions on behalf of users, which may lead to the injection of malicious scripts (Stored XSS). This affects versions up to 1.3.5, creating potential security risks for websites utilizing this plugin.

Affected Version(s)

Clickbank WordPress Plugin (Niche Storefront) <= 1.3.5

References

https://patchstack.com/database/wordpress/plugin/clickban...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Xuan Chien (Patchstack Alliance)
.