Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-22705: Disqus Popular Posts plugin can be tricked to run code

CVE-2025-22705 · published 1 year ago

Summary

The Disqus Popular Posts add‑on (versions up to 2.1.1) can be manipulated by an attacker to insert malicious script into a website. This could let someone steal user data or perform actions on behalf of logged‑in users. Update the plugin to the latest version or disable it until a fix is applied.

Original advisory text

Cross-Site Request Forgery (CSRF) vulnerability in godthor Disqus Popular Posts disqus-popular-posts allows Reflected XSS.This issue affects Disqus Popular Posts: from n/a through <= 2.1.1.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.1 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-352Cross-Site Request Forgery (CSRF)

Timeline

Published14 Feb 2025

Updated26 Oct 2026

First seen7 Mar 2026

Sources

CVE-2025-22705 · NVD

Track software like this

Free during beta