CVE-2025-1362: easy-broken-link-checker <= 9.0.2 - Bulk Actions via CSRF

Description

The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting customers via CSRF attacks

Classification

CVE ID: CVE-2025-1362

Problem Types

CWE-79 Cross-Site Scripting (XSS) CWE-352 Cross-Site Request Forgery (CSRF)

Affected Products

Vendor: Unknown

Product: URL Shortener | Conversion Tracking | AB Testing | WooCommerce

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.03% (probability of being exploited)

EPSS Percentile: 6.5% (scored less or equal to compared to others)

EPSS Date: 2025-04-07 (when was this score calculated)

References

https://nvd.nist.gov/vuln/detail/CVE-2025-1362
https://wpscan.com/vulnerability/035cc502-a514-440f-8808-5655c8c915e2/

Timeline