CVE-2025-64271CWE-352csrf

CVE-2025-64271

Medium · published November 13, 2025

CVSS v3.1

4.3

EPSS

Percentile

1.4

In the wild

Unconfirmed

What it is

Cross-Site Request Forgery (CSRF) vulnerability in HasThemes WP Plugin Manager wp-plugin-manager allows Cross Site Request Forgery.This issue affects WP Plugin Manager: from n/a through <= 1.4.7.

The record

Technical detail

CVSS v3.1: 4.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00114 · 1.4th percentile
Weakness: CWE-352 · Cross-Site Request Forgery (CSRF)
Published: 2025-11-13T15:15Z

Affected products (1)

Product	Versions	Fixed in
hasthemes/wp_plugin_manager	< 1.4.8	1.4.8

References (1)

https://patchstack.com/database/Wordpress/Plugin/wp-plugin-manager/vulnerability/wordpress-wp-plugin-manager-plugin-1-4-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · [email protected]

EPSS history

Timeline

13 NOV 09:24Z
WordPress WP Plugin Manager plugin <= 1.4.7 - Cross Site Request Forgery (CSRF) vulnerability
cvelistv5