PT-2025-4513 · Unknown · Tock Widget

0Xd4Rk5Id3 · Published 2025-01-07 · Updated 2025-01-07 · CVE-2025-22520

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Tock Widget versions n/a through 1.1

Description The issue is related to a Cross-Site Request Forgery (CSRF) problem, which allows for Cross Site Request Forgery. This is a type of attack where an attacker can trick a user into performing unintended actions on a web application that the user is authenticated to.

Recommendations For versions n/a through 1.1, as a temporary workaround, consider implementing proper CSRF token validation to prevent unauthorized requests. Restrict access to sensitive functionality to minimize the risk of exploitation. Avoid using the affected widget until the issue is resolved or a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-22520

Affected Products

Tock Widget

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-22520 · Security Note
• https://twitter.com/CVEnew/status/1876647482618437894 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/tock-widget/vulnerability/wordpress-tock-widget-plugin-1-1-csrf-to-stored-xss-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/Wordpress/Plugin/tock-widget/vulnerability/wordpress-tock-widget-plugin-1-1-csrf-to-stored-xss-vulnerability?_s_id=cve · Note