What is the CVSS score of EUVD-2025-17301?

EUVD-2025-17301 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by EUVD-2025-17301?

A high-severity CSRF vulnerability combined with Stored XSS in the Konami Easter Egg plugin (v0.4 and earlier) could allow attackers to perform unauthorized actions and inject malicious content that…

How to fix or mitigate EUVD-2025-17301?

Within 24 hours: Inventory all systems using Konami Easter Egg plugin and assess exposure; disable the plugin if non-critical. Within 7 days: Implement WAF rules to block suspicious POST requests to the vulnerable component and monitor for exploitation attempts. Within 30 days: Contact the vendor for patch availability, evaluate alternative solutions, or plan plugin removal if updates are not forthcoming.

Wordpress Plugin EUVD-2025-17301

| CVE-2025-49425 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-06-06 audit@patchstack.com

WordPress XSS CSRF Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17301

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 13:15 nvd

HIGH 7.1

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in Adrian Hanft Konami Easter Egg allows Stored XSS. This issue affects Konami Easter Egg: from n/a through v0.4.

AnalysisAI

Cross-Site Request Forgery (CSRF) vulnerability in Adrian Hanft's Konami Easter Egg browser extension (versions through v0.4) that can lead to Stored Cross-Site Scripting (XSS) attacks. An attacker can craft a malicious request to inject persistent JavaScript code that executes in the context of affected users' browsers, potentially compromising user sessions, stealing credentials, or performing unauthorized actions. With a CVSS score of 7.1 and network-accessible attack vector requiring only user interaction, this vulnerability poses a moderate-to-significant risk to users of the extension, though real-world exploitation likelihood depends on whether public exploits exist and the extension's actual user base.

Technical ContextAI

The vulnerability exists in Adrian Hanft's Konami Easter Egg extension, a browser add-on that typically detects the classic Konami Code (↑↑↓↓←→←→BA) input sequence. The root cause is classified under CWE-352 (Cross-Site Request Forgery), which indicates insufficient CSRF token validation or same-origin policy enforcement. The vulnerability's mechanism leverages the combination of CSRF (allowing forged requests without proper authorization checks) and Stored XSS (permitting unsanitized user input to be persisted and executed). Browser extensions operate with elevated privileges and can interact with arbitrary web pages, making CSRF-XSS chains particularly dangerous. The extension likely accepts user input or configuration that is neither properly validated against CSRF attacks nor sanitized before storage and execution, violating both OWASP A01:2021 (Broken Access Control) and A03:2021 (Injection).

RemediationAI

Immediate actions: (1) Users should disable or uninstall Konami Easter Egg extension immediately if running v0.4 or earlier; (2) Extension administrators should upgrade to a patched version beyond v0.4 once available (current patch version not specified in provided data—check official extension repository or GitHub for updates); (3) Developers should implement: CSRF token validation on all state-changing requests, Content Security Policy (CSP) headers to prevent inline script execution, input sanitization and output encoding for all user-controllable data, and security review of extension permissions. Browser administrators can disable the extension via policy if mass remediation is needed. Without explicit patch version information in the provided data, recommend checking the Adrian Hanft GitHub repository or official extension store (Chrome Web Store, Firefox Add-ons, etc.) for v0.5+ or security patches labeled as CSRF/XSS fixes.