Cross-Site Request Forgery in Konami Easter Egg Plugin by Adrian Hanft
CVE-2025-49425

7.1HIGH

Key Information:

Vendor

WordPress
Status
Konami Easter Egg
Vendor
CVE Published:
6 June 2025

What is CVE-2025-49425?

A Cross-Site Request Forgery vulnerability in the Konami Easter Egg plugin allows attackers to exploit the plugin and execute unauthorized commands on behalf of users. This issue can potentially lead to Stored Cross-Site Scripting, where malicious scripts are stored on the target server. Users of the plugin versions from n/a through v0.4 are advised to review their security settings to mitigate potential risks.

Affected Version(s)

Konami Easter Egg <= n/a

References

https://patchstack.com/database/wordpress/plugin/konami-e...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Miki Iwamoto (Patchstack Alliance)
.
CVE-2025-49425 : Cross-Site Request Forgery in Konami Easter Egg Plugin by Adrian Hanft