PT-2025-5914 · Unknown · Venugopal Show Notice/Message On Admin Area

Soprobro · Published 2025-02-07 · Updated 2025-02-12 · CVE-2025-25075

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Venugopal Show notice or message on admin area versions n/a through 2.0

Description The issue is a Cross-Site Request Forgery (CSRF) vulnerability that allows Stored XSS in the Venugopal Show notice or message on admin area. This vulnerability enables an attacker to perform unauthorized actions on the admin area.

Recommendations For versions n/a through 2.0, update to a version that includes a fix for this issue, as no specific workaround is provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-25075

Affected Products

Venugopal Show Notice/Message On Admin Area

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-25075 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/show-notice-or-message-on-admin-area/vulnerability/wordpress-show-notice-or-message-on-admin-area-plugin-2-0-csrf-to-stored-xss-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/wordpress/plugin/show-notice-or-message-on-admin-area/vulnerability/wordpress-show-notice-or-message-on-admin-area-plugin-2-0-csrf-to-stored-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/cracbot/status/1889630624002220290 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1887853691216048417 · Twitter Post
• https://twitter.com/CVEnew/status/1887812419642359972 · Twitter Post