What is the CVSS score of CVE-2025-60172?

CVE-2025-60172 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Flytedesk Digital are affected by CVE-2025-60172?

A critical CSRF vulnerability in Flytedesk Digital WordPress plugin (through v20181101) allows attackers to inject persistent malicious code into your WordPress site through administrator accounts,…

How to fix or mitigate CVE-2025-60172?

Within 24 hours: Disable and deactivate the Flytedesk Digital plugin immediately via WordPress admin dashboard; document all administrator accounts and review admin access logs for suspicious activity in the past 30 days. Within 7 days: Uninstall the plugin completely; scan your WordPress installation for injected JavaScript or backdoors using a security scanner (e.g., Wordfence, Sucuri); audit all administrator account activity and reset passwords for all admin users. Within 30 days: Identify a maintained alternative plugin with equivalent functionality; implement a Web Application Firewall (WAF) rule to block requests to this plugin's endpoints; conduct a full security audit of your WordPress environment and implement role-based access controls limiting administrator privileges.

Flytedesk Digital CVE-2025-60172

HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-09-26 audit@patchstack.com

CSRF XSS

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 01:17 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 19:14 vuln.today

CVE Published

Sep 26, 2025 - 09:15 nvd

HIGH 7.1

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in flytedesk Flytedesk Digital allows Stored XSS. This issue affects Flytedesk Digital: from n/a through 20181101.

AnalysisAI

CSRF vulnerability in Flytedesk Digital WordPress plugin through version 20181101 enables stored cross-site scripting (XSS) attacks. Remote attackers can trick authenticated administrators into executing malicious requests that inject persistent JavaScript into the application, affecting site visitors. EPSS score of 0.01% indicates minimal observed exploitation activity, and no public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

This vulnerability combines two weaknesses in a WordPress plugin: Cross-Site Request Forgery (CWE-352) as the initial vector and stored XSS as the payload. The CSRF flaw allows attackers to bypass the WordPress nonce protection mechanism that should validate administrative actions. Once exploited, the attacker can submit forged requests that inject malicious JavaScript into database-stored content (such as plugin settings, post content, or custom fields), which then executes in the context of other users' browsers when they view the affected pages. The WordPress plugin architecture requires proper implementation of wp_nonce_field() and check_admin_referer() functions to prevent such attacks. The 'S:C' (changed scope) in the CVSS vector indicates the injected XSS can affect resources beyond the vulnerable component itself, impacting site visitors who were not the initial CSRF targets.

Affected ProductsAI

Flytedesk Digital WordPress plugin versions from earliest release through version 20181101 (November 1, 2018) are confirmed vulnerable according to Patchstack vulnerability database. The plugin appears to be distributed through WordPress.org plugin repository. No CPE identifier is available in NVD data. Vendor advisory and detailed affected version information can be found at https://patchstack.com/database/wordpress/plugin/flytedesk-digital/vulnerability/wordpress-flytedesk-digital-plugin-20181101-cross-site-request-forgery-csrf-vulnerability.

RemediationAI

No vendor-released patch has been identified at time of analysis - the affected version 20181101 dates to 2018 with no subsequent updates documented. Immediate action: uninstall the Flytedesk Digital plugin and migrate to actively maintained alternatives for similar functionality. If business requirements mandate continued use, implement defense-in-depth controls: restrict WordPress administrator access to trusted networks only via .htaccess IP whitelisting or VPN requirements (reduces CSRF attack surface but adds operational friction for remote admins), enable Content Security Policy headers to mitigate stored XSS impact with 'script-src self' directive (may break legitimate plugin functionality requiring inline scripts), conduct code audit to manually add wp_nonce verification to all administrative forms and check_admin_referer() calls in processing functions (requires PHP development expertise and ongoing maintenance burden). Each workaround has significant operational trade-offs and none address the root vulnerability. Plugin replacement is the only sustainable remediation. Refer to Patchstack advisory for technical details: https://patchstack.com/database/wordpress/plugin/flytedesk-digital/vulnerability/wordpress-flytedesk-digital-plugin-20181101-cross-site-request-forgery-csrf-vulnerability.