CVE-2025-1288

MEDIUM

WOOEXIM <5.0.0 - CSRF leading to XSS

Title source: llm

Description

The WOOEXIM WordPress plugin through 5.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make an unauthenticated user vulnerable to reflected XSS via a CSRF attack.

References (1)

[Exploit, Third Party Advisory] https://wpscan.com/vulnerability/175af35d-6972-42c9-b7ac-913ce1fbac64/

Scores

CVSS v3 6.1

EPSS 0.0008

EPSS Percentile 22.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Classification

CWE

CWE-352

Status published

Affected Products (1)

bulktheme/wooexim < 5.0.0

Timeline

Published May 15, 2025

Tracked Since Feb 18, 2026