CVE-2025-62933CWE-352csrf

CVE-2025-62933

High · published October 27, 2025

CVSS v3.1
7.1
EPSS
0%
Percentile
1.9
In the wild
Unconfirmed
What it is

⚠️ A sneaky CSRF vulnerability in Awesome Testimonials could turn user experiences into malware delivery systems! 😱 Think of it like a restaurant where someone can change your order without you knowing, resulting in a dish you never wanted to eat. This CSRF flaw allows attackers to submit unauthorized actions, leading to stored XSS vulnerabilities that can impact your site’s credibility. If exploited, this vulnerability lets attackers inject malicious scripts that run on users' browsers when they visit the site, making it possible for them to steal sensitive information or even impersonate users. You could be serving up harmful content without realizing it, which is absolutely devastating for user trust and site reputation!

Put simply

Think of it like a restaurant where someone can change your order without you knowing, resulting in a dish you never wanted to eat. This CSRF flaw allows attackers to submit unauthorized actions, leading to stored XSS vulnerabilities that can impact your site’s credibility. This CSRF vulnerability in Awesome Testimonials allows attackers to execute stored XSS by tricking logged-in users into submitting unauthorized requests that affect the application's data.

What to do

If exploited, this vulnerability lets attackers inject malicious scripts that run on users' browsers when they visit the site, making it possible for them to steal sensitive information or even impersonate users. You could be serving up harmful content without realizing it, which is absolutely devastating for user trust and site reputation! Update Awesome Testimonials to version 2.2.2 or later to mitigate this vulnerability. Additionally, consider implementing CSRF tokens and verifying requests to ensure they originate from authorized users. Always monitor your site for suspicious activity. You've got this! Patch it up, and your site will be more secure than ever! 🛡️

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00123 · 1.9th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2025-10-27T06:15Z
References (1)
EPSS history
Timeline
  • 27 OCT 01:34Z
    WordPress Awesome Testimonials plugin <= 2.2.1 - Cross Site Request Forgery (CSRF) vulnerability
    cvelistv5