PT-2025-38863 · Pebas · Couponxxl

Bonds · Published 2025-09-22 · Updated 2025-09-22 · CVE-2025-58013

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pebas CouponXxL versions through 4.5.0

Description A Cross-Site Request Forgery (CSRF) issue exists in pebas CouponXxL, potentially allowing Privilege Escalation. This occurs due to insufficient validation of requests, which could allow an attacker to perform actions on behalf of an authenticated user without their knowledge. The vulnerability could be exploited by crafting a malicious web request that, when triggered (e.g., through a link or image tag), performs unauthorized actions on the targeted application.

Recommendations Update pebas CouponXxL to a version beyond 4.5.0.

Fix

LPE

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-58013

Affected Products

Couponxxl

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-58013 · Security Note
• https://twitter.com/CVEnew/status/1970255689064063436 · Twitter Post
• https://patchstack.com/database/wordpress/theme/couponxxl/vulnerability/wordpress-couponxxl-theme-4-5-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/Wordpress/Theme/couponxxl/vulnerability/wordpress-couponxxl-theme-4-5-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Note
• https://twitter.com/CveFindCom/status/1970196792928002144 · Twitter Post