What is the CVSS score of EUVD-2025-28462?

EUVD-2025-28462 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by EUVD-2025-28462?

A high-severity vulnerability in Bluff Post versions up to 1.1.1 allows attackers to inject malicious code through cross-site request forgery and stored XSS attacks, potentially compromising user…

How to fix or mitigate EUVD-2025-28462?

Within 24 hours: Audit all Bluff Post installations to identify affected versions (≤1.1.1) and document exposure scope. Within 7 days: Implement WAF rules to block suspicious POST requests and XSS payloads targeting Bluff Post endpoints; disable user-generated content features if feasible. Within 30 days: Monitor vendor for patch availability; evaluate alternative plugins; prepare rollback or upgrade procedures; conduct security awareness training on social engineering risks.

Wordpress Plugin EUVD-2025-28462

| CVE-2025-52784 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-06-20 audit@patchstack.com

WordPress XSS CSRF Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-28462

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

CVE Published

Jun 20, 2025 - 15:15 nvd

HIGH 7.1

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in hideoguchi Bluff Post allows Stored XSS. This issue affects Bluff Post: from n/a through 1.1.1.

AnalysisAI

CVE-2025-52784 is a Cross-Site Request Forgery (CSRF) vulnerability in hideoguchi Bluff Post that enables Stored XSS attacks, affecting versions through 1.1.1. An unauthenticated attacker can craft malicious requests to inject persistent JavaScript payloads that execute in victims' browsers when they view affected content, potentially leading to session hijacking, credential theft, or defacement. The vulnerability has a CVSS score of 7.1 (High) with network-based attack vector and low complexity, indicating moderate real-world risk.

Technical ContextAI

The vulnerability stems from inadequate CSRF token validation (CWE-352) combined with insufficient input sanitization that allows stored XSS payloads. Bluff Post likely processes user-submitted content without proper token verification on state-changing operations (POST/PUT/DELETE) and fails to encode output contexts, allowing attackers to bypass client-side protections. The CSRF weakness enables an attacker to forge requests from authenticated users, while the stored XSS component persists malicious scripts in the application's database. This dual vulnerability requires the application to validate CSRF tokens on all state-changing requests and implement context-aware output encoding (HTML, JavaScript, URL, CSS contexts) using established libraries or templating engines with auto-escaping.

RemediationAI

Immediate: Upgrade hideoguchi Bluff Post to version 1.1.2 or later (patch version not explicitly confirmed in provided data; verify with vendor). Interim mitigations if patch unavailable: (1) Implement strict CSRF token validation on all POST/PUT/DELETE endpoints using SameSite=Strict cookies and synchronizer token pattern; (2) Apply context-aware output encoding to all user-submitted content before rendering (use established libraries like DOMPurify for JavaScript contexts, htmlspecialchars() for HTML, or templating engines with auto-escape); (3) Implement Content Security Policy (CSP) with script-src restrictions to limit XSS blast radius; (4) Deploy Web Application Firewall (WAF) rules to detect and block common XSS payloads; (5) Restrict posting permissions to authenticated users only if possible. Contact hideoguchi maintainers for official patch timeline.