PT-2025-39558 · Javothemes · Javo Core

Published 2025-09-26 · Updated 2025-10-01 · CVE-2025-60111

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Javothemes Javo Core versions through 3.0.0.266

Description A Cross-Site Request Forgery (CSRF) issue exists in Javothemes Javo Core, potentially allowing Authentication Bypass. This occurs due to insufficient validation of requests, which could allow an attacker to perform actions on behalf of an authenticated user without their knowledge.

Recommendations Update Javo Core to a version later than 3.0.0.266.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-60111

Affected Products

Javo Core

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-60111 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/javo-core/vulnerability/wordpress-javo-core-plugin-3-0-0-266-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1971499226350899234 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/javo-core/vulnerability/wordpress-javo-core-plugin-3-0-0-266-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Note
• https://twitter.com/cracbot/status/1973342188021969392 · Twitter Post