{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-7669", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-07-14T21:50:55.409Z", "datePublished": "2025-07-19T02:22:58.889Z", "dateUpdated": "2026-04-08T17:04:18.978Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:04:18.978Z"}, "affected": [{"vendor": "avishika", "product": "Avishi WP PayPal Payment Button", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Avishi WP PayPal Payment Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0. This is due to missing or incorrect nonce validation on the 'avishi-wp-paypal-payment-button/index.php' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Avishi WP PayPal Payment Button <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8416b394-28ae-41de-8784-2ae39f4d201f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/avishi-wp-paypal-payment-button/trunk/index.php"}, {"url": "https://wordpress.org/plugins/avishi-wp-paypal-payment-button/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "JohSka"}], "timeline": [{"time": "2025-07-18T14:11:43.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-21T16:55:08.641081Z", "id": "CVE-2025-7669", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-21T16:55:19.602Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-7669", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-07-14T21:50:55.409Z", "datePublished": "2025-07-19T02:22:58.889Z", "dateUpdated": "2025-07-21T16:55:19.602Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-07-19T02:22:58.889Z"}, "affected": [{"vendor": "avishika", "product": "Avishi WP PayPal Payment Button", "versions": [{"version": "*", "status": "affected", "lessThanOrEqual": "2.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Avishi WP PayPal Payment Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0. This is due to missing or incorrect nonce validation on the 'avishi-wp-paypal-payment-button/index.php' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Avishi WP PayPal Payment Button <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8416b394-28ae-41de-8784-2ae39f4d201f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/avishi-wp-paypal-payment-button/trunk/index.php"}, {"url": "https://wordpress.org/plugins/avishi-wp-paypal-payment-button/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Johannes Skamletz"}], "timeline": [{"time": "2025-07-18T14:11:43.000+00:00", "lang": "en", "value": "Disclosed"}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-7669", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-21T16:55:08.641081Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-21T16:55:13.038Z"}}]}}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Avishi WP PayPal Payment Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0. This is due to missing or incorrect nonce validation on the 'avishi-wp-paypal-payment-button/index.php' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El complemento Avishi WP PayPal Payment Button para WordPress es vulnerable a cross-site request forgery en todas las versiones hasta la 2.0 incluida. Esto se debe a la falta o a una validaci\u00f3n incorrecta del nonce en la p\u00e1gina 'avishi-wp-paypal-payment-button/index.php'. Esto permite que atacantes no autenticados actualicen la configuraci\u00f3n e inyecten scripts web maliciosos mediante una solicitud falsificada, ya que pueden enga\u00f1ar al administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-7669", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-07-19T03:15:23.727", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/avishi-wp-paypal-payment-button/trunk/index.php"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/avishi-wp-paypal-payment-button/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8416b394-28ae-41de-8784-2ae39f4d201f?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T03:56:12.718315+00:00", "value": {"mitigation_remediation": ["Update the plugin to the latest release that contains a fix for the CSRF issue (any version beyond 2.0).", "If an update is not yet available, disable or uninstall the Avishi WP PayPal Payment Button plugin until a patch is released.", "Ensure that your WordPress installation enforces CSRF protection on admin forms, and consider deploying a web application firewall or security plugin to block forged requests and contain potential XSS payloads."], "summary": {"action": "Patch Plugin", "impact": "Stored XSS via CSRF"}, "threat_synthesis": {"affected_systems": "The affected product is the Avishi WP PayPal Payment Button plugin distributed by Avishika, with all releases up to and including version 2.0. Administrators running any of these versions on a WordPress installation are vulnerable.", "description_and_impact": "The Avishi WP PayPal Payment Button plugin for WordPress suffers from missing or incorrect nonce validation, which allows any unauthenticated user to construct a forged request that a site administrator will execute when clicking a link or performing a benign action. By using this flaw, an attacker can modify the plugin\u2019s settings and embed malicious JavaScript, resulting in stored cross\u2011site scripting that is served to all visitors of the affected site. This stored script can be used to deface content, track user behavior, or redirect users to phishing sites.", "risk_and_exploitability": "With a CVSS score of 6.1, the vulnerability represents moderate severity, and the EPSS score of less than 1\u2009% indicates a low likelihood of exploitation at present. The issue is not listed in the CISA KEV catalog and no public exploits are known. An attacker would need to lure an administrator into submitting a crafted request, at which point the vulnerability could be used to store arbitrary scripts that affect every site user. Therefore, the risk is significant if the plugin version is still running, but exploitation probability remains low until a verified exploit appears."}}}}, "created": "2026-04-21T04:00:10.071423+00:00", "updated": "2026-04-21T04:00:10.071434+00:00", "vendors": []}