Cross-Site Request Forgery in Mavis HTTPS to HTTP Redirection by PressPage Entertainment Inc
CVE-2025-58261

7.1HIGH

Key Information:

Vendor

WordPress
Status
Mavis Https To Http Redirection
Vendor
CVE Published:
22 September 2025

What is CVE-2025-58261?

A Cross-Site Request Forgery (CSRF) vulnerability in the Mavis HTTPS to HTTP Redirection plugin allows attackers to exploit user sessions, potentially leading to Stored Cross-Site Scripting (XSS). This vulnerability impacts versions from n/a up to 1.4.3, highlighting the risks associated with inadequate validation of requests. Users are advised to update their plugins to latest versions to mitigate these security risks.

Affected Version(s)

Mavis HTTPS to HTTP Redirection <= 1.4.3

References

https://patchstack.com/database/wordpress/plugin/mavis-ht...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Xuan Chien (Patchstack Alliance)
JSON
.