Cross-Site Request Forgery Vulnerability in BP Profile as Homepage by Jatinder Pal Singh
CVE-2025-49453

7.1HIGH

Key Information:

Vendor

WordPress
Status
Bp Profile As Homepage
Vendor
CVE Published:
6 June 2025

What is CVE-2025-49453?

A Cross-Site Request Forgery (CSRF) vulnerability exists in the BP Profile as Homepage plugin developed by Jatinder Pal Singh. This security flaw permits attackers to execute stored cross-site scripting (XSS) attacks, which could lead to unauthorized actions being performed on behalf of the user without their consent. The affected versions of the plugin include those from n/a to 1.1, making it crucial for users to update their installations to safeguard against possible exploits.

Affected Version(s)

BP Profile as Homepage <= 1.1

References

https://patchstack.com/database/wordpress/plugin/bp-profi...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

johska (Patchstack Alliance)
.
CVE-2025-49453 : Cross-Site Request Forgery Vulnerability in BP Profile as Homepage by Jatinder Pal Singh