CVE-2025-25126

Summary

CVE-2025-25126 is a newly disclosed vulnerability affecting the ZMSEO software version 1.14.1 and below. This issue combines two serious security concerns: Cross-Site Request Forgery (CSRF) and Stored Cross-Site Scripting (XSS). An attacker exploiting the CSRF vulnerability could manipulate users into performing unwanted actions on the affected system. Simultaneously, the Stored XSS component enables an attacker to inject malicious scripts into web pages, potentially stealing sensitive data or taking control of user sessions. Both vulnerabilities pose significant risks and require immediate attention from ZMSEO users to apply the necessary patches.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.