Cross-Site Request Forgery Vulnerability in Create Posts & Terms by Valentin Agachi
CVE-2025-49351

7.1HIGH

Key Information:

Vendor

WordPress
Status
Create Posts & Terms
Vendor
CVE Published:
9 December 2025

What is CVE-2025-49351?

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Create Posts & Terms plugin by Valentin Agachi, allowing attackers to manipulate user interactions without their consent. This weakness can lead to Stored XSS issues, compromising users' security and privacy when exploiting affected versions up to 1.3.1. Website administrators must address this vulnerability promptly to mitigate potential risks associated with unauthorized actions.

Affected Version(s)

Create Posts &amp; Terms <= n/a

References

https://vdp.patchstack.com/database/Wordpress/Plugin/crea...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Xuan Chien | Patchstack Bug Bounty Program
JSON
.