Cross-Site Request Forgery Vulnerability in Allegro Marketing Plugin for WordPress
CVE-2025-60075

7.1HIGH

Key Information:

Vendor

WordPress
Status
HPb Seo Plugin For WordPress
Vendor
CVE Published:
29 October 2025

What is CVE-2025-60075?

The Allegro Marketing hpb seo plugin for WordPress is affected by a Cross-Site Request Forgery (CSRF) vulnerability that allows unauthorized actions to be performed on behalf of logged-in users. This vulnerability could potentially lead to reflected XSS attacks. It is crucial for users of the hpb seo plugin, specifically versions up to 3.0.1, to be aware of and address this security issue to protect their WordPress installations from unauthorized manipulation and exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

hpb seo plugin for WordPress <= n/a

References

https://patchstack.com/database/Wordpress/Plugin/hpbseo/v...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Xuan Chien | Patchstack Bug Bounty Program
JSON
.