What is the CVSS score of EUVD-2025-17153?

EUVD-2025-17153 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by EUVD-2025-17153?

A cross-site request forgery vulnerability combined with stored cross-site scripting in the BP Profile as Homepage plugin (versions through 1.1) could allow attackers to hijack user sessions and…

How to fix or mitigate EUVD-2025-17153?

Within 24 hours: Audit all installations of BP Profile as Homepage plugin and document affected systems; disable the plugin on non-critical systems if patching is not immediately possible. Within 7 days: Implement input validation and output encoding at the application layer; deploy WAF rules to detect and block CSRF tokens and XSS payloads targeting the vulnerable plugin endpoints; conduct a security review of affected user accounts for unauthorized changes. Within 30 days: Contact the plugin vendor for patch availability and establish a deployment timeline; if no patch is released, evaluate alternative plugins or implement comprehensive network segmentation to restrict access to affected applications.

Wordpress Plugin EUVD-2025-17153

| CVE-2025-49453 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-06-06 audit@patchstack.com

WordPress XSS CSRF Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17153

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 13:16 nvd

HIGH 7.1

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in Jatinder Pal Singh BP Profile as Homepage allows Stored XSS. This issue affects BP Profile as Homepage: from n/a through 1.1.

AnalysisAI

CSRF vulnerability in Jatinder Pal Singh BP Profile as Homepage plugin (versions through 1.1) that enables Stored XSS attacks. An unauthenticated attacker can exploit this via a malicious web request to inject persistent JavaScript into the application, affecting all users who view the compromised profile. The vulnerability requires user interaction (CVSS UI:R) but has cross-site scope impact (S:C), resulting in a 7.1 medium-high severity rating; KEV status and active exploitation data are not currently available in public disclosures.

Technical ContextAI

This vulnerability combines two distinct weaknesses: CWE-352 (Cross-Site Request Forgery) and Stored XSS. The root cause is insufficient CSRF token validation in the BP Profile as Homepage plugin, allowing attackers to craft forged requests that modify user profile data. The Stored XSS component indicates that input validation is also bypassed, permitting JavaScript payloads to be persisted in the profile homepage field. When other users visit the affected profile (AV:N - Network accessible), the malicious script executes in their browsers. The plugin likely runs on WordPress or similar CMS platforms given the naming convention. No specific CPE data was provided, but the affected product is: Jatinder Pal Singh BP Profile as Homepage, versions 1.1 and earlier.

RemediationAI

Update BP Profile as Homepage plugin to version 1.2 or later immediately. 2. If running version 1.1, disable the plugin until patching. 3. Workaround: Implement a Web Application Firewall (WAF) rule to block POST requests to profile modification endpoints lacking valid CSRF tokens. 4. Conduct a site audit to identify and remove any injected JavaScript from user profiles created during the vulnerability window. 5. Implement Content Security Policy (CSP) headers to mitigate XSS impact. 6. Review user profile content for malicious scripts and sanitize stored data. Note: No vendor advisory URL or specific patch version number was provided in the CVE data; consult the official plugin repository or vendor website for patch availability.