WordPress Block Country plugin <= 1.0 - Cross Site Request Forgery (CSRF) zu Stored XSS Schwachstelle

Successful exploitation of CVE-2025-48077 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser. This can lead to various malicious actions, including session hijacking, account takeover, and defacement of the website. The attacker could steal sensitive information like cookies or authentication tokens, gaining unauthorized access to user accounts. The blast radius extends to any user interacting with the affected Block Country plugin, making it a significant security risk for WordPress sites utilizing this functionality.

Websites utilizing the Block Country plugin, particularly those with user accounts or forms that accept user input, are at risk. Shared hosting environments where multiple websites share the same server resources are also at increased risk, as a compromised plugin on one site could potentially impact others.

• wordpress / composer / npm:

grep -r 'nithinmaurya12 Block Country' /var/www/html/
wp plugin list | grep 'Block Country'

• generic web:

curl -I https://your-wordpress-site.com/wp-content/plugins/block-country/ | grep -i 'x-frame-options'

1. 2025-11-06Disclosure

   disclosure

1. Reserviert2025-05-15
2. Veröffentlicht2025-11-06
3. Geändert2026-04-28
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-48077 is to immediately upgrade the Block Country WordPress plugin to version 1.0.1 or later. If upgrading is not immediately feasible, consider implementing strict Content Security Policy (CSP) headers to restrict script execution from untrusted sources. Additionally, implement CSRF protection mechanisms on all plugin forms to prevent unauthorized requests. Regularly review user input and sanitize data to prevent malicious code injection.

Aktive Installationen

70

Plugin-Bewertung