CVE-2025-6041

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-6041", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-12T20:26:39.948Z", "datePublished": "2025-07-04T01:44:01.931Z", "dateUpdated": "2026-04-08T16:38:20.836Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:38:20.836Z"}, "affected": [{"vendor": "yonisink", "product": "yContributors", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "0.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The yContributors plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5. This is due to missing or incorrect nonce validation on the 'yContributors' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "yContributors <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1bd61124-d4af-4c88-be96-579c735b7b49?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ycontributors/trunk/ycontributors_admin.php#L19"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "JohSka"}], "timeline": [{"time": "2025-07-03T12:23:34.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-08T14:28:41.953291Z", "id": "CVE-2025-6041", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-08T14:28:52.014Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-6041", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-08T14:28:41.953291Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-08T14:28:47.100Z"}}], "cna": {"title": "yContributors <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "JohSka"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "yonisink", "product": "yContributors", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-03T12:23:34.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1bd61124-d4af-4c88-be96-579c735b7b49?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ycontributors/trunk/ycontributors_admin.php#L19"}], "descriptions": [{"lang": "en", "value": "The yContributors plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5. This is due to missing or incorrect nonce validation on the 'yContributors' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:38:20.836Z"}}}, "cveMetadata": {"cveId": "CVE-2025-6041", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:38:20.836Z", "dateReserved": "2025-06-12T20:26:39.948Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-04T01:44:01.931Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "yContributors", "vendor": "yonisink", "versions": [{"lessThanOrEqual": "0.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The yContributors plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5. This is due to missing or incorrect nonce validation on the 'yContributors' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El complemento yContributors para WordPress es vulnerable a Cross-Site Request Forgery en todas las versiones hasta la 0.5 incluida. Esto se debe a la falta o a una validaci\u00f3n de nonce incorrecta en la p\u00e1gina \"yContributors\". Esto permite que atacantes no autenticados actualicen la configuraci\u00f3n e inyecten scripts web maliciosos mediante una solicitud falsificada, ya que pueden enga\u00f1ar al administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-6041", "lastModified": "2026-06-17T10:01:02.980", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-6041", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-07-08T14:28:41.953291Z", "version": "2.0.3"}}]}, "published": "2025-07-04T03:15:22.080", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ycontributors/trunk/ycontributors_admin.php#L19"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1bd61124-d4af-4c88-be96-579c735b7b49?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T14:43:22.712983+00:00", "value": {"mitigation_remediation": ["Upgrade the yContributors plugin to the latest available version (any release newer than\u00a00.5) to eliminate the missing nonce verification.", "If an upgrade cannot be applied immediately, verify that the plugin\u2019s settings page correctly checks a nonce and restricts form submissions to authenticated administrators only. This restores protection against CSRF.", "Scan the WordPress database for any unexpected script tags inserted by the plugin and remove them. After cleanup, clear relevant caches so that no malicious payloads remain accessible.", "As a further precaution, consider disabling or removing the yContributors plugin until a patched version is available, or use a security plugin to block CSRF requests to the plugin\u2019s admin URLs."], "summary": {"action": "Patch Plugin", "impact": "Stored Cross\u2011Site Scripting via CSRF"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the \u201cyContributors\u201d plugin authored by yonisink, any WordPress installation that has version\u00a00.5\u00a0or earlier of the plugin installed. No specific sub\u2011versions are listed beyond the\u00a00.5\u00a0cutoff. Administrators running those old releases are at risk.", "description_and_impact": "The yContributors WordPress plugin has a CSRF flaw that allows an unauthenticated attacker to submit forged requests to the plugin\u2019s settings page. Because the page lacks proper nonce validation, the attacker can modify configuration values and inject arbitrary JavaScript that is persisted in the database. When any site visitor loads the affected page, the malicious script runs, giving the attacker the ability to deface content, hijack user sessions, or exfiltrate data. The weakness is an example of CWE\u2011352, a Cross\u2011Site Request Forgery that leads to Stored Cross\u2011Site Scripting.", "risk_and_exploitability": "The CVSS score of 6.1 indicates moderate severity. The EPSS score is below 1%, suggesting that exploitation is currently rare and likely requires a targeted attack where an administrator is tricked into clicking a malicious link. The vulnerability is not listed in CISA\u2019s KEV catalog. An attacker would load a crafted URL or button on an external site that, when a logged\u2011in administrator visits, sends the forged request to the WordPress admin interface. Successful exploitation results in a stored XSS payload being delivered to end users."}}}}, "created": "2025-07-13T21:47:35.417048+00:00", "updated": "2026-04-22T14:45:19.294741+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}