What is the CVSS score of EUVD-2025-28459?

EUVD-2025-28459 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by EUVD-2025-28459?

A Cross-Site Request Forgery vulnerability combined with Stored XSS has been identified in Logo Manager For Samandehi (versions through 0.5), allowing attackers to execute malicious actions on behalf…

How to fix or mitigate EUVD-2025-28459?

Within 24 hours: Identify all instances of Logo Manager For Samandehi in your environment and document affected systems; disable the plugin if not mission-critical. Within 7 days: Implement Web Application Firewall (WAF) rules to block CSRF tokens bypass attempts and XSS payloads targeting the logo upload/management functionality; conduct user access review for suspicious activity. Within 30 days: Contact the vendor for patch availability timeline; evaluate alternative logo management solutions; plan migration if patch is not released within 60 days.

Wordpress Plugin EUVD-2025-28459

| CVE-2025-52780 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-06-20 audit@patchstack.com

WordPress XSS CSRF Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-28459

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

CVE Published

Jun 20, 2025 - 15:15 nvd

HIGH 7.1

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in Mohammad Parsa Logo Manager For Samandehi allows Stored XSS. This issue affects Logo Manager For Samandehi: from n/a through 0.5.

AnalysisAI

CVE-2025-52780 is a CSRF vulnerability in Mohammad Parsa Logo Manager For Samandehi (versions through 0.5) that enables Stored XSS attacks, allowing unauthenticated attackers to perform unauthorized actions and inject malicious scripts affecting other users. The vulnerability has a CVSS score of 7.1 (High) and exploits weak CSRF protections in an admin/management plugin, with the attack requiring user interaction (UI:R) but affecting multiple users via stored payload persistence.

Technical ContextAI

The vulnerability exists in the Logo Manager For Samandehi WordPress plugin, a file/asset management component for the Samandehi e-commerce platform. The root cause is CWE-352 (Cross-Site Request Forgery), which indicates insufficient or missing CSRF token validation on state-changing operations. The plugin fails to implement proper nonce verification on form submissions that modify logo assets, allowing attackers to craft malicious requests. The presence of Stored XSS (as mentioned in the description) suggests the CSRF vulnerability allows injection of unsanitized data into persistent storage, compounding the severity—an attacker can forge a request to submit logo data containing JavaScript payloads that execute in admin and user browsers when the logo is subsequently rendered. This combination of CSRF + Stored XSS creates a persistent threat affecting all site visitors.

RemediationAI

Update Logo Manager For Samandehi to version > 0.5 when released by Mohammad Parsa. Monitor vendor's official repository/WordPress Plugin Directory for security updates.; priority: Critical Workaround (Temporary): Disable the Logo Manager plugin until a patched version is available. If functionality is required, restrict plugin admin access via firewall rules or .htaccess to trusted IP ranges only.; priority: High Mitigation: Implement Web Application Firewall (WAF) rules to detect and block CSRF attacks targeting logo upload/management endpoints. Monitor for suspicious logo asset submissions containing script tags (<script>, onclick, onerror, etc.). Enforce Content Security Policy (CSP) headers to limit inline script execution.; priority: High Preventive Code Fix: Vendor must implement WordPress nonce verification using wp_verify_nonce() on all POST/PUT requests modifying logo data. Sanitize and escape all logo metadata output with esc_attr(), wp_kses_post(), or equivalent. Validate logo file types server-side.; priority: Critical