Cross-Site Request Forgery Vulnerability in WP Permalink Translator by Hossin Asaadi
CVE-2025-53274

7.1HIGH

Key Information:

Vendor

WordPress
Status
WP Permalink Translator
Vendor
CVE Published:
27 June 2025

What is CVE-2025-53274?

A Cross-Site Request Forgery (CSRF) vulnerability in the WP Permalink Translator plugin by Hossin Asaadi allows attackers to trick users into executing unwanted actions on a web application where they are authenticated. This weakness can lead to Stored XSS, enabling attackers to inject malicious scripts that may compromise user data and site integrity. The affected versions include all before 1.7.6, underscoring the need for users to update promptly to mitigate potential risks.

Affected Version(s)

WP Permalink Translator <= 1.7.6

References

https://patchstack.com/database/wordpress/plugin/wp-perma...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Skalucy (Patchstack Alliance)
.