Cross-Site Request Forgery Vulnerability in Hoernerfranz WP-CalDav2ICS Plugin
CVE-2025-59131

7.1HIGH

Key Information:

Vendor

WordPress
Status
WP-caldav2ics
Vendor
CVE Published:
30 December 2025

What is CVE-2025-59131?

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Hoernerfranz WP-CalDav2ICS plugin, allowing attackers to exploit it by initiating unauthorized actions on behalf of affected users. This security flaw enables the potential for stored cross-site scripting (XSS) attacks, compromising user data and website integrity. Users are advised to update their plugin to mitigate these security risks and enhance protection against unauthorized actions.

Affected Version(s)

WP-CalDav2ICS <= 1.3.4

References

https://vdp.patchstack.com/database/wordpress/plugin/wp-c...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muhammad Nur Ibnu Hubab | Patchstack Bug Bounty Program
JSON
.
CVE-2025-59131 : Cross-Site Request Forgery Vulnerability in Hoernerfranz WP-CalDav2ICS Plugin