PT-2025-20208 · Unknown · Themarketer2023 Themarketer

Nguyen Xuan Chien · Published 2025-05-07 · Updated 2025-05-07 · CVE-2025-47655

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions themarketer2023 theMarketer versions 1.4.7 and earlier

Description A Cross-Site Request Forgery (CSRF) issue allows Stored XSS. This means an attacker can execute malicious scripts on the victim's browser, potentially leading to unauthorized actions.

Recommendations For themarketer2023 theMarketer versions 1.4.7 and earlier, update to a version that fixes this issue, as no specific workaround is provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-47655

Affected Products

Themarketer2023 Themarketer

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-47655 · Security Note
• https://twitter.com/CVEnew/status/1920130507851084014 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/themarketer/vulnerability/wordpress-themarketer-plugin-1-4-7-csrf-to-stored-xss-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/wordpress/plugin/themarketer/vulnerability/wordpress-themarketer-plugin-1-4-7-csrf-to-stored-xss-vulnerability?_s_id=cve · Note