CVE-2025-2163

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-2163", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-03-10T13:40:11.683Z", "datePublished": "2025-03-15T03:23:23.156Z", "dateUpdated": "2026-04-08T16:43:40.574Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:43:40.574Z"}, "affected": [{"vendor": "zoorum", "product": "Zoorum Comments", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "0.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Zoorum Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due to missing or incorrect nonce validation on the zoorum_set_options() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Zoorum Comments <= 0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2b58fb0f-c7ac-4ee6-84f1-ac14617a7c2b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/zoorum-comments/tags/0.9/zoorum-comments-admin.php#L18"}, {"url": "https://plugins.trac.wordpress.org/browser/zoorum-comments/tags/0.9/zoorum-comments-admin.php#L38"}, {"url": "https://wordpress.org/plugins/zoorum-comments/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "JohSka"}], "timeline": [{"time": "2025-03-14T14:24:07.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-17T21:25:28.275965Z", "id": "CVE-2025-2163", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-17T21:28:30.044Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-2163", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-17T21:25:28.275965Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-17T21:25:29.542Z"}}], "cna": {"title": "Zoorum Comments <= 0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "JohSka"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "zoorum", "product": "Zoorum Comments", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.9"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-03-14T14:24:07.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2b58fb0f-c7ac-4ee6-84f1-ac14617a7c2b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/zoorum-comments/tags/0.9/zoorum-comments-admin.php#L18"}, {"url": "https://plugins.trac.wordpress.org/browser/zoorum-comments/tags/0.9/zoorum-comments-admin.php#L38"}, {"url": "https://wordpress.org/plugins/zoorum-comments/"}], "descriptions": [{"lang": "en", "value": "The Zoorum Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due to missing or incorrect nonce validation on the zoorum_set_options() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:43:40.574Z"}}}, "cveMetadata": {"cveId": "CVE-2025-2163", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:43:40.574Z", "dateReserved": "2025-03-10T13:40:11.683Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-03-15T03:23:23.156Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Zoorum Comments", "vendor": "zoorum", "versions": [{"lessThanOrEqual": "0.9", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zoorum:zoorum_comments:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "2BFEC991-B8A8-458D-866A-CB2F4E227811", "versionEndIncluding": "0.9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Zoorum Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due to missing or incorrect nonce validation on the zoorum_set_options() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El complemento Zoorum Comments para WordPress es vulnerable a Cross-Site Request Forgery en todas las versiones hasta la 0.9 incluida. Esto se debe a la falta o a una validaci\u00f3n incorrecta de nonce en la funci\u00f3n zoorum_set_options(). Esto permite que atacantes no autenticados actualicen la configuraci\u00f3n e inyecten scripts web maliciosos mediante una solicitud falsificada, ya que pueden enga\u00f1ar al administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-2163", "lastModified": "2026-06-17T09:06:26.847", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-2163", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-03-17T21:25:28.275965Z", "version": "2.0.3"}}]}, "published": "2025-03-15T04:15:22.073", "references": [{"source": "security@wordfence.com", "tags": ["Broken Link"], "url": "https://plugins.trac.wordpress.org/browser/zoorum-comments/tags/0.9/zoorum-comments-admin.php#L18"}, {"source": "security@wordfence.com", "tags": ["Broken Link"], "url": "https://plugins.trac.wordpress.org/browser/zoorum-comments/tags/0.9/zoorum-comments-admin.php#L38"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://wordpress.org/plugins/zoorum-comments/"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2b58fb0f-c7ac-4ee6-84f1-ac14617a7c2b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-352"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T17:47:55.761558+00:00", "value": {"mitigation_remediation": ["Update the Zoorum Comments plugin to the latest release that includes a proper nonce check, or, if no newer version is available, uninstall the plugin entirely.", "If an update is not immediately possible, restrict the zoorum_set_options() endpoint to authenticated users with an elevated role by adding a capability check or by enabling strict nonce verification in the code.", "Apply a web application firewall rule or use a security plugin to detect and block CSRF requests targeting the plugin\u2019s option update endpoint, and advise administrators never to click links from untrusted sources."], "summary": {"action": "Apply Patch", "impact": "Stored XSS via CSRF"}, "threat_synthesis": {"affected_systems": "WordPress sites running the Zoorum Comments plugin version 0.9 or earlier are affected. The vulnerability is present in all releases up to and including 0.9, regardless of the WordPress core version. Site administrators who have the plugin active and are logged in need to be aware of the risk because the vulnerability requires an admin to submit a POST request that updates the plugin settings. No operating systems or hosting environments are specifically singled out, but any environment that runs WordPress with this plugin is at risk.", "description_and_impact": "The Zoorum Comments plugin for WordPress has a missing or incorrect nonce check in the zoorum_set_options() function. Because of this, an attacker can forge a request and trick an administrator into triggering the update settings action. The forged request allows the attacker to inject arbitrary JavaScript into the plugin\u2019s settings, which is then persisted and served to every visitor of the site. The flaw combines a Cross\u2011Site Request Forgery weakness (CWE\u2011352) with Stored Cross\u2011Site Scripting (CWE\u201179), giving the attacker the ability to compromise the confidentiality and integrity of data seen by all users of the affected site and potentially take control of user sessions. The impact is that any user browsing the compromised site could execute malicious code, leading to defacement, credential theft or further lateral movement on the host system.", "risk_and_exploitability": "The CVSS score of 6.1 indicates a medium severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in CISA\u2019s KEV catalog. However, the attack still requires an unauthenticated attacker to lure an administrator into clicking a malicious link or visiting a crafted page. Once the request is forged, the settings update writes the attacker\u2019s script to the database, leaving a persistent payload that runs for all site visitors. The relatively low exploit probability does not eliminate the risk because the resulting stored XSS can enable data exfiltration, session hijacking, or the installation of backdoors for long\u2011term compromise. Security teams should treat the flaw as noteworthy, especially on high\u2011profile or sensitive WordPress sites."}}}}, "created": "2026-04-22T18:00:05.475764+00:00", "updated": "2026-04-22T18:00:05.475775+00:00", "vendors": []}