What is the CVSS score of CVE-2025-62080?

CVE-2025-62080 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-62080

MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-12-31 audit@patchstack.com

WordPress CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

4.3 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 31, 2025 - 16:15 nvd

N/A

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in Channelize.io Team Live Shopping & Shoppable Videos For WooCommerce live-shopping-video-streams allows Cross Site Request Forgery.This issue affects Live Shopping & Shoppable Videos For WooCommerce: from n/a through <= 2.2.0.

AnalysisAI

Cross-Site Request Forgery (CSRF) vulnerability in Channelize.io Team Live Shopping & Shoppable Videos For WooCommerce plugin version 2.2.0 and earlier allows unauthenticated attackers to perform unwanted actions on behalf of authenticated users through forged requests. The vulnerability affects the WordPress plugin used to enable live shopping and shoppable video streams in WooCommerce stores. No public exploit code has been identified, and the EPSS score of 0.02% indicates low exploitation probability despite the CSRF attack vector.

Technical ContextAI

This is a classic Cross-Site Request Forgery (CWE-352) vulnerability in a WordPress WooCommerce plugin. CSRF flaws occur when an application does not properly validate that requests originate from legitimate users, allowing attackers to craft malicious links or forms that execute unintended actions when visited by authenticated users. The Channelize.io Live Shopping plugin integrates live video streaming with WooCommerce commerce functionality; lack of CSRF token validation in its endpoints means attackers can potentially manipulate live shopping operations, modify video stream settings, or trigger unauthorized transactions by tricking logged-in shop administrators or customers into visiting attacker-controlled pages.

Affected ProductsAI

Channelize.io Team Live Shopping & Shoppable Videos For WooCommerce plugin (live-shopping-video-streams) in versions 2.2.0 and earlier. The plugin is distributed through the WordPress plugin ecosystem and identified by the WooCommerce product category. Exact CPE designation for WordPress plugins is not standardized, but the vulnerability affects all installations of this plugin on WordPress sites with WooCommerce active.

RemediationAI

Update the Channelize.io Team Live Shopping & Shoppable Videos For WooCommerce plugin to a version newer than 2.2.0 immediately. Check the plugin's update mechanism within WordPress admin dashboard or contact Channelize.io support at audit@patchstack.com for confirmation of patched versions. The primary fix is upgrading beyond the vulnerable version; no workaround is available for CSRF vulnerabilities other than disabling the plugin. Refer to the Patchstack vulnerability database entry (https://patchstack.com/database/Wordpress/Plugin/live-shopping-video-streams/vulnerability/wordpress-live-shopping-shoppable-videos-for-woocommerce-plugin-2-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve) for vendor remediation timeline and patch availability confirmation.