CVE-2025-63019

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2026-01-22

Last updated on: 2026-04-27

Assigner: Patchstack

Description

Insertion of Sensitive Information Into Sent Data vulnerability in Johan Jonk Stenström Cookies and Content Security Policy cookies-and-content-security-policy allows Retrieve Embedded Sensitive Data.This issue affects Cookies and Content Security Policy: from n/a through <= 2.34.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-22

Last Modified

2026-04-27

Generated

2026-07-06

AI Q&A

2026-01-22

EPSS Evaluated

2026-07-05

NVD

CVE-2025-63019

Affected Vendors & Products

Vendor	Product	Version / Range
patchstack	cookies_and_content_security_policy	to 2.34 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-201	The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Attack-Flow Graph

Executive Summary

This vulnerability in the WordPress Cookies and Content Security Policy Plugin (up to version 2.34) allows unauthenticated attackers to retrieve embedded sensitive information that should normally be restricted. It is classified as a Sensitive Data Exposure issue, meaning sensitive data can be accessed improperly without special privileges. [1]

Impact Analysis

The vulnerability can lead to unauthorized access to sensitive information, which may enable attackers to exploit other system weaknesses. Although the severity is considered low (CVSS score 5.3), it still poses a risk of data exposure and potential further exploitation. [1]

Detection Guidance

This vulnerability can be detected by checking the version of the Cookies and Content Security Policy WordPress plugin installed on your system. If the version is 2.34 or earlier, it is vulnerable. You can use WordPress CLI commands such as `wp plugin list` to check the plugin version. Additionally, monitoring for unusual access to sensitive data or unauthorized data exposure in logs may help detect exploitation attempts. There are no specific commands provided for direct detection of this vulnerability. [1]

Mitigation Strategies

The immediate step to mitigate this vulnerability is to update the Cookies and Content Security Policy plugin to version 2.35 or later, as this version addresses the vulnerability. Additionally, enabling auto-updates for plugins can help ensure timely patching. Since no special privileges are required to exploit this vulnerability, prompt updating is critical to reduce risk. [1]

Compliance Impact

The provided resources do not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Hi! I’m here to help you understand CVE-2025-63019. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70