CVE-2025-39416 HIGH

CVE-2025-39416: WordPress translit it! plugin <= 1.6 - CSRF to Stored XSS vulnerability

Vendor Ichi
Product translit it!
Weakness CWE-352 · CSRF
Published April 17, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in Ichi translit it! translit-it allows Stored XSS.This issue affects translit it!: from n/a through <= 1.6.

Key dates

02Disclosure timeline

April 17, 2025 CVE published
April 28, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-36690 WordPress WPLMS Theme < 4.900 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2024-34756 WordPress Integration for HubSpot and Contact Form 7 plugin <= 1.3.1 - Cross Site Request Forgery (CSRF) vulnerability CVE-2023-51358 WordPress Block IPs for Gravity Forms Plugin <= 1.0.1 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2023-0086 JetWidgets for Elementor <= 1.0.12 - Cross-Site Request Forgery to Settings Update CVE-2025-50036 WordPress Mailing Group Listserv plugin <= 3.0.5 - Cross Site Request Forgery (CSRF) Vulnerability