Skip to main content

Smart Online Order For Clover CVE-2025-15635

| EUVDEUVD-2025-209479 MEDIUM
Cross-Site Request Forgery (CSRF) (CWE-352)
2026-04-15 Patchstack GHSA-qf4m-4g7r-r2qp
WordPress CSRF Smart Online Order For Clover Wordpress Plugin Zaytech
4.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
4.3 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

3
Analysis Generated
Jul 26, 2026 - 15:30 vuln.today
EUVD ID Assigned
Apr 15, 2026 - 16:30 euvd
EUVD-2025-209479
CVE Published
Apr 15, 2026 - 15:49 nvd
MEDIUM 4.3

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in Zaytech Smart Online Order for Clover allows Cross Site Request Forgery.This issue affects Smart Online Order for Clover: from n/a through 1.6.0.

AnalysisAI

Cross-Site Request Forgery in the Smart Online Order for Clover WordPress plugin allows unauthenticated attackers to trick logged-in administrators into performing unintended actions, such as modifying plugin settings or creating orders. The vulnerability affects versions up to 1.6.0, requires user interaction (admin clicking a crafted link), and has a low CVSS score of 4.3. No active exploitation has been reported (CISA SSVC: exploitation none) and the EPSS exploitation probability is very low (0.01%).

More in Smart Online Order For Clover

View all
CVE-2026-66700 HIGH
7.1 Aug 13

Unauthenticated reflected cross-site scripting (XSS) in Zaytech's Smart Online Order for Clover WordPress plugin, affect
CVE-2024-7032 MEDIUM
6.5 Aug 21

The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capab
CVE-2024-29115 MEDIUM
6.5 Mar 19

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zaytech Smart Onli
CVE-2024-8787 MEDIUM
6.1 Oct 16

The Smart Online Order for Clover plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of
CVE-2023-46312 MEDIUM
6.1 Oct 31

Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
CVE-2024-31238 MEDIUM
5.4 Apr 12

Cross-Site Request Forgery (CSRF) vulnerability in Zaytech Smart Online Order for Clover.5.5. Rated medium severity (CVS
CVE-2024-9895 MEDIUM
5.4 Oct 15

The Smart Online Order for Clover plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's moo
CVE-2024-43253 MEDIUM
5.3 Nov 01

Missing Authorization vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders.5.6. Rated medium seve
CVE-2024-43254 MEDIUM
4.3 Nov 01

Missing Authorization vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders.5.6. Rated medium seve
CVE-2024-7030 MEDIUM
4.3 Aug 21

The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized modification of data due to a missi

Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)

View all
CVE-2016-6277 HIGH POC
8.8
CVE-2014-100005 HIGH POC
8.0
CVE-2013-5696 MEDIUM POC
6.8
CVE-2020-36836 HIGH POC
8.0
CVE-2015-2295 MEDIUM POC
6.8
CVE-2016-6897 MEDIUM POC
6.5
CVE-2022-41622 HIGH POC
8.8
CVE-2025-2907 CRITICAL POC
9.8

Same technique CSRF

View all
CVE-2016-6277 HIGH POC
8.8
CVE-2014-100005 HIGH POC
8.0
CVE-2017-9757 HIGH POC
8.8
CVE-2013-5696 MEDIUM POC
6.8
CVE-2013-4152 MEDIUM POC
6.8
CVE-2024-7094 CRITICAL
9.8
CVE-2015-4624 HIGH POC
7.5
CVE-2020-36836 HIGH POC
8.0

Share

CVE-2025-15635 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy