{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-6053", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-13T12:33:48.149Z", "datePublished": "2025-07-18T04:23:02.813Z", "dateUpdated": "2026-04-08T17:27:23.433Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:27:23.433Z"}, "affected": [{"vendor": "bogdansilivestru", "product": "Zuppler Online Ordering", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Zuppler Online Ordering plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.0. This is due to missing or incorrect nonce validation on the 'zuppler-online-ordering-options' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Zuppler Online Ordering <= 2.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dab1dbc7-f188-4c04-9c8b-465ec0a42548?source=cve"}, {"url": "https://wordpress.org/plugins/zuppler-online-ordering/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "JohSka"}], "timeline": [{"time": "2025-07-17T16:22:56.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-18T14:46:57.583966Z", "id": "CVE-2025-6053", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-18T14:56:39.449Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-6053", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-18T14:46:57.583966Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-18T14:54:37.662Z"}}], "cna": {"title": "Zuppler Online Ordering <= 2.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "JohSka"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "bogdansilivestru", "product": "Zuppler Online Ordering", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.1.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-17T16:22:56.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dab1dbc7-f188-4c04-9c8b-465ec0a42548?source=cve"}, {"url": "https://wordpress.org/plugins/zuppler-online-ordering/"}], "descriptions": [{"lang": "en", "value": "The Zuppler Online Ordering plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.0. This is due to missing or incorrect nonce validation on the 'zuppler-online-ordering-options' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:27:23.433Z"}}}, "cveMetadata": {"cveId": "CVE-2025-6053", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:27:23.433Z", "dateReserved": "2025-06-13T12:33:48.149Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-18T04:23:02.813Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Zuppler Online Ordering plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.0. This is due to missing or incorrect nonce validation on the 'zuppler-online-ordering-options' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El complemento Zuppler Online Ordering para WordPress es vulnerable a cross-site request forgery en todas las versiones hasta la 2.1.0 incluida. Esto se debe a la falta o la validaci\u00f3n incorrecta de nonce en la p\u00e1gina \"zuppler-online-ordering-options\". Esto permite que atacantes no autenticados actualicen la configuraci\u00f3n e inyecten scripts web maliciosos mediante una solicitud falsificada, ya que pueden enga\u00f1ar al administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-6053", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-07-18T05:15:31.750", "references": [{"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/zuppler-online-ordering/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dab1dbc7-f188-4c04-9c8b-465ec0a42548?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T22:14:21.170912+00:00", "value": {"mitigation_remediation": ["Upgrade to the latest release of Zuppler Online Ordering or remove the plugin altogether", "Implement nonce verification for every admin\u2011only write operation in the plugin; if the code is modifiable, re\u2011introduce the missing check on the options endpoint", "Limit access to the options page by tightening role capabilities, ensuring that only users with the necessary permissions can reach the vulnerable function so any forged request would fail"], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting via CSRF"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Zuppler Online Ordering WordPress plugin developed by bogdansilivestru, in all releases up to and including version 2.1.0. Users running any of these versions are potentially exposed.", "description_and_impact": "The Zuppler Online Ordering plugin for WordPress is vulnerable to Cross\u2011Site Request Forgery due to missing or incorrect nonce validation on the options page. An unauthenticated attacker can forge a request that an authenticated administrator might submit, which updates plugin settings and injects malicious scripts that are then stored. The result is stored cross\u2011site scripting that affects every visitor to the site, jeopardizing confidentiality, integrity, and availability of the web application. This flaw is a classic example of the missing or ineffective access control found in CWE\u2011352.", "risk_and_exploitability": "The CVSS base score of 6.1 indicates a moderate severity level. The EPSS score is less than 1%, suggesting that exploitation is unlikely in the wild in the near term, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to provoke an administrator to click a crafted link while the victim is logged in with administrative privileges. Once the forged request succeeds, an attacker can inject arbitrary script that will run in the context of any user accessing the site, making this risk primarily a cross\u2011site scripting threat rather than a direct remote code execution scenario."}}}}, "created": "2025-07-21T15:17:13.820994+00:00", "updated": "2026-04-20T22:15:06.201421+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}