CVE-2025-25160

Summary

CVE-2025-25160 is a newly disclosed vulnerability affecting the Mark Barnes Style Tweaker plugin. This issue combines both Cross-Site Request Forgery (CSRF) and Stored Cross-Site Scripting (XSS) vulnerabilities. Attackers can exploit the CSRF weakness to force unintended actions from a user, while the Stored XSS component enables the injection of malicious scripts that can persist even after user logout. The vulnerability is found in versions of Style Tweaker ranging from n/a to 0.11. Users are advised to update their installations as soon as possible to mitigate these risks.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.