CVE-2025-25139

Summary

CVE-2025-25139 is a newly identified vulnerability affecting the WP Custom Post RSS Feed plugin developed by Cynob IT Consultancy. This issue combines Cross-Site Request Forgery (CSRF) and Stored Cross-Site Scripting (XSS) vulnerabilities, enabling unauthorized users to execute malicious scripts on a victim's website. The flaw exists in the plugin, impacting versions from n/a up to 1.0.0. Successful exploitation of this vulnerability could result in unauthorized modification or theft of sensitive data, posing a significant risk to affected websites. It is crucial for users of this plugin to apply the necessary patches or upgrades as soon as possible to mitigate this threat.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.