CVE-2025-48359
BaseFortify
Publication date: 2025-08-28
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| patchstack | att_youtube_widget | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Request Forgery (CSRF) in the ATT YouTube Widget WordPress plugin (version 1.0 and earlier) that can lead to Stored Cross-Site Scripting (XSS). An attacker can trick authenticated users with higher privileges into performing unauthorized actions, which then store malicious scripts that execute in the context of the victim's browser. The plugin is abandoned and unpatched, making it a persistent risk. [1]
How can this vulnerability impact me? :
The vulnerability can allow attackers to execute malicious scripts in the context of authenticated users, potentially leading to data theft, session hijacking, or unauthorized actions within the affected website. Since the plugin is abandoned and unpatched, the risk remains unless the plugin is replaced or a virtual patch is applied. Simply deactivating the plugin does not fully mitigate the risk. [1]
What immediate steps should I take to mitigate this vulnerability?
Since the ATT YouTube Widget plugin is abandoned and has no official fix, immediate mitigation steps include replacing the plugin with a secure alternative. Simply deactivating the plugin does not fully eliminate the risk unless a virtual patch (vPatch) is applied. Patchstack offers virtual patching solutions that provide immediate protection even without official patches. Therefore, users are strongly advised to either apply a virtual patch from Patchstack or replace the plugin urgently to mitigate potential exploitation. [1]