CVE-2025-25154

Summary

CVE-2025-25154 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Custom Comment Notifications plugin from version n/a to 1.0.8. An attacker can exploit this issue to execute Stored XSS (Cross-Site Scripting) attacks on unsuspecting users. The CSRF flaw enables an attacker to craft malicious requests that can be executed when a user visits a specially crafted website or clicks a malicious link. Successful exploitation of this vulnerability can result in the injection of malicious scripts into the user's browser, potentially leading to data theft or further compromises. Users are strongly advised to update their Custom Comment Notifications plugin to the latest version to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.