CVE-2025-62080: CSRF in Live Shopping & Shoppable Videos

The CSRF vulnerability allows an attacker to execute actions on behalf of an authenticated user without their knowledge or consent. This could include modifying product listings, changing settings, or even initiating live shopping sessions. An attacker could craft a malicious link or embed it in a website or email, and when a user clicks it, the attacker's code will be executed with the user's privileges. The potential impact is significant, as it could lead to unauthorized modifications to the WooCommerce store and potentially compromise customer data or disrupt operations. This is similar to other CSRF vulnerabilities where user actions are performed without explicit consent.

1. Reserved2025-10-07
2. Published2025-12-31
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation is to upgrade to a version of the Live Shopping & Shoppable Videos For WooCommerce plugin that contains the fix. If upgrading immediately is not possible, consider implementing a Content Security Policy (CSP) to restrict the sources from which the browser can load resources. Additionally, implement strict input validation and output encoding to prevent malicious scripts from being injected. Monitor web application firewalls (WAFs) for suspicious requests originating from untrusted sources. After upgrading, verify the fix by attempting to trigger the CSRF vulnerability with a test account and confirming that the action is blocked.

Active installs

600Niche

Plugin rating