PT-2025-54280 · WordPress · Recent Posts From Each Category

Skalucy · Publicado 2025-12-31 · Atualizado 2026-01-05 · CVE-2025-49354

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Mindstien Technologies Recent Posts From Each Category versions 1.4 and earlier

Description The Recent Posts From Each Category plugin contains a Cross-Site Request Forgery (CSRF) issue and a Stored Cross-Site Scripting (XSS) issue. The CSRF flaw could allow an attacker to perform actions on behalf of an authenticated user. The Stored XSS flaw could allow an attacker to inject malicious scripts into the application, which could be executed by other users.

Recommendations Versions prior to 1.4 should be updated.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2025-49354

Produtos afetados

Recent Posts From Each Category

Referências · 8

• https://twitter.com/CVEnew/status/2006332214154575955 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-49354 · Nota de Segurança
• https://patchstack.com/database/wordpress/plugin/recent-posts-from-each-category/vulnerability/wordpress-recent-posts-from-each-category-plugin-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Nota
• https://twitter.com/cracbot/status/2008131419835679229 · Publicação no Twitter
• https://patchstack.com/database/Wordpress/Plugin/recent-posts-from-each-category/vulnerability/wordpress-recent-posts-from-each-category-plugin-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Nota
• https://t.me/CVEtracker/41033 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2006279405551718677 · Publicação no Twitter
• https://vdp.patchstack.com/database/wordpress/plugin/recent-posts-from-each-category/vulnerability/wordpress-recent-posts-from-each-category-plugin-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Nota