What is the CVSS score of CVE-2025-52781?

CVE-2025-52781 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by CVE-2025-52781?

A Cross-Site Request Forgery vulnerability affecting Beee TinyNav versions through 1.4 could allow attackers to perform unauthorized actions on behalf of authenticated users and inject malicious…

How to fix or mitigate CVE-2025-52781?

Within 24 hours: Identify all systems running Beee TinyNav and assess user exposure; document inventory and access controls. Within 7 days: Implement Web Application Firewall (WAF) rules to block suspicious CSRF patterns and disable TinyNav functionality if non-critical; apply input validation and output encoding. Within 30 days: Monitor vendor channels for patch availability; conduct security review of alternative navigation solutions; plan upgrade timeline once patch is released.

Wordpress Plugin CVE-2025-52781

EUVD-2025-28460 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-06-20 audit@patchstack.com

WordPress XSS CSRF Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-28460

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

CVE Published

Jun 20, 2025 - 15:15 nvd

HIGH 7.1

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in Beee TinyNav allows Stored XSS. This issue affects TinyNav: from n/a through 1.4.

AnalysisAI

CVE-2025-52781 is a Cross-Site Request Forgery (CSRF) vulnerability in Beee TinyNav versions up to 1.4 that enables Stored XSS attacks. An unauthenticated attacker can craft malicious requests to inject persistent JavaScript payloads into the application, which are then executed in the browsers of other users who interact with the compromised content. With a CVSS score of 7.1 and network-based attack vector requiring only user interaction, this vulnerability poses a moderate-to-significant risk to affected deployments, particularly if actively exploited in the wild or publicly disclosed with proof-of-concept code.

Technical ContextAI

The vulnerability exists in Beee TinyNav (CPE: cpe:2.3:a:beee:tinynav:*:*:*:*:*:*:*:*), a navigation/menu library/component, affecting versions from an unspecified baseline through version 1.4. The root cause is classified under CWE-352 (Cross-Site Request Forgery), which indicates insufficient CSRF token validation or SameSite cookie protections. The combination with Stored XSS suggests that CSRF protection mechanisms either do not validate state-changing requests or fail to sanitize user-supplied input before storage and rendering. This allows an attacker to forge requests on behalf of authenticated users without their consent, and the stored XSS component indicates that injected payloads persist in the application's database or backend state, bypassing typical reflected XSS mitigations. The vulnerability likely affects web applications that integrate TinyNav without additional server-side input validation, output encoding, or CSRF token implementation.

RemediationAI

Immediate remediation steps: (1) Upgrade Beee TinyNav to version 1.5 or later (if available) as a priority—patch version not explicitly stated in provided data, but vendor should publish a fix; contact Beee/project maintainers for patched release; (2) Implement server-side CSRF token validation on all state-changing endpoints using standard library functions (e.g., synchronizer tokens, double-submit cookies with SameSite=Strict); (3) Enforce Content Security Policy (CSP) headers with script-src restrictions to mitigate stored XSS even if CSRF succeeds; (4) Apply output encoding/HTML entity escaping to all user-supplied input before rendering; (5) Enable SameSite cookie attribute (SameSite=Strict or SameSite=Lax) to restrict cross-site request credential submission; (6) Conduct input validation and sanitization at the server layer, not client-side only. Short-term workaround for unpatched systems: disable or isolate TinyNav functionality behind additional authentication layers or IP restrictions until a patch is applied.