PT-2025-5158 · Payform · Payform

Soprobro · Published 2025-01-16 · Updated 2025-01-16 · CVE-2025-23872

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions PayForm versions prior to 2.0

Description The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability, which also allows Stored XSS. This means an attacker can perform unintended actions on a user's account without their knowledge or consent, and also store malicious scripts that can be executed by other users.

Recommendations For versions prior to 2.0, update to version 2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive functions that may be exploited through CSRF or Stored XSS until a patch is available.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-23872

Affected Products

Payform

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-23872 · Security Note
• https://patchstack.com/database/wordpress/plugin/payform/vulnerability/wordpress-payform-plugin-2-0-csrf-to-stored-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1880020024431178214 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/payform/vulnerability/wordpress-payform-plugin-2-0-csrf-to-stored-xss-vulnerability?_s_id=cve · Note