CVE-2025-49346CWE-352

WordPress Simple Archive Generator plugin <= 5.2 - Cross Site Request Forgery (CSRF) vulnerability

High · published December 31, 2025

CVSS v3.1
7.1
EPSS
0%
Percentile
1.5
In the wild
Unconfirmed
What it is

⚡ A malicious user could easily exploit a CSRF vulnerability in Simple Archive Generator, allowing them to inject harmful scripts without breaking a sweat! 😱 Think of it like a sneaky chef who can replace an ingredient in a dish without anyone noticing — a simple request results in harmful changes that can affect everyone at the table! 🍽️ If exploited, an attacker could store malicious scripts that run whenever unsuspecting users access the affected application, potentially leading to stolen data, session hijacking, or worse. It's like serving a dessert that looks delicious but is laced with something dangerous — users won't know until it's too late!

Put simply

Think of it like a sneaky chef who can replace an ingredient in a dish without anyone noticing — a simple request results in harmful changes that can affect everyone at the table! 🍽️ This CSRF vulnerability allows an attacker to trick users into performing actions without their consent, which can lead to Stored Cross-Site Scripting (XSS) if the application doesn't properly validate input. Versions from n/a to 5.2 are affected, making it a critical issue for users of Simple Archive Generator.

What to do

If exploited, an attacker could store malicious scripts that run whenever unsuspecting users access the affected application, potentially leading to stolen data, session hijacking, or worse. It's like serving a dessert that looks delicious but is laced with something dangerous — users won't know until it's too late! Immediately update Simple Archive Generator to the latest version to patch this vulnerability. Additionally, implement CSRF tokens in forms and ensure proper sanitation of user inputs to prevent XSS attacks. Don't wait — make these changes now! You've got this! Take these steps and you'll be a security hero in no time! 🦸

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00115 · 1.5th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2025-12-31T04:37Z
EPSS history
Timeline
  • 31 DEC 04:37Z
    WordPress Simple Archive Generator plugin <= 5.2 - Cross Site Request Forgery (CSRF) vulnerability
    cvelistv5