Cross-Site Request Forgery in NewsMAN NewsmanApp by NewsMAN
CVE-2025-60164

7.1HIGH

Key Information:

Vendor

WordPress
Status
Newsmanapp
Vendor
CVE Published:
26 September 2025

What is CVE-2025-60164?

The NewsMAN NewsmanApp is susceptible to a Cross-Site Request Forgery (CSRF) attack, which may lead to the execution of unauthorized commands on behalf of an authenticated user. This vulnerability also facilitates stored Cross-Site Scripting (XSS), presenting a significant risk as it can enable attackers to inject malicious scripts into web pages viewed by users. Users and administrators of NewsmanApp versions up to 2.7.7 should take immediate action to mitigate this risk by applying available security patches.

Affected Version(s)

NewsmanApp <= 2.7.7

References

https://patchstack.com/database/wordpress/plugin/newsmana...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nabil Irawan (Patchstack Alliance)
JSON
.
CVE-2025-60164 : Cross-Site Request Forgery in NewsMAN NewsmanApp by NewsMAN