CVE-2025-25072

Summary

CVE-2025-25072 is a newly discovered vulnerability affecting the WP Admin Custom Page plugin. This issue involves a Cross-Site Request Forgery (CSRF) vulnerability that also allows Stored XSS attacks. The CSRF flaw enables an unauthenticated attacker to perform malicious actions on behalf of a victim, while the Stored XSS component lets attackers inject malicious code into a webpage viewed by other users. The vulnerability affects WP Admin Custom Page versions from n/a through 1.5.0. Updating to the latest, secure version is highly recommended to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.