« Back to list

CVE-2025-31585

Status: DeferredHigh (7.1)—

Cross-Site Request Forgery (CSRF) vulnerability in leadfox Leadfox for WordPress leadfox allows Cross Site Request Forgery.This issue affects Leadfox for WordPress: from n/a through <= 2.1.9.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

Vulnerabilidad CSRF en plugin WordPress con UI:R (requiere interacción del usuario para ejecutar acciones no autorizadas). La interacción del usuario es requisito clave para T1203.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

User TrainingUser Account ManagementApplication Isolation and SandboxingExploit ProtectionUpdate Software

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Leadfox — LeadfoxAI

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2025-31585",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-31585",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-31T15:38:55.610082Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "audit@patchstack.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "audit@patchstack.com",
      "affectedData": [
        {
          "vendor": "leadfox",
          "product": "Leadfox for WordPress",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "2.2.0",
                  "status": "unaffected"
                }
              ],
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "2.1.9"
            }
          ],
          "packageName": "leadfox",
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-03-31T13:15:51.710",
  "references": [
    {
      "url": "https://patchstack.com/database/Wordpress/Plugin/leadfox/vulnerability/wordpress-leadfox-for-wordpress-plugin-2-1-8-csrf-to-stored-xss-vulnerability?_s_id=cve",
      "source": "audit@patchstack.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "audit@patchstack.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-Site Request Forgery (CSRF) vulnerability in leadfox Leadfox for WordPress leadfox allows Cross Site Request Forgery.This issue affects Leadfox for WordPress: from n/a through <= 2.1.9."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de Cross-Site Request Forgery (CSRF) en leadfox Leadfox for WordPress permite Cross-Site Request Forgery. Este problema afecta a Leadfox para WordPress desde la versión n/d hasta la 2.1.8."
    }
  ],
  "lastModified": "2026-06-17T09:10:37.720",
  "sourceIdentifier": "audit@patchstack.com"
}