Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-63040: Post Snippets CSRF: Malicious websites can trick users into performing actions

CVE-2025-63040 · published 10 months ago

Summary

The Post Snippets plugin has a security weakness that allows a malicious website to trick users into making unintended changes to their website. This can happen when a user visits a malicious site while logged in to their Post Snippets account. To fix this, update Post Snippets to version 4.0.12 or later.

Original advisory text

Cross-Site Request Forgery (CSRF) vulnerability in Saad Iqbal Post Snippets post-snippets allows Cross Site Request Forgery.This issue affects Post Snippets: from n/a through <= 4.0.11.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

4.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-352Cross-Site Request Forgery (CSRF)

Timeline

Published31 Dec 2025

Updated26 Oct 2026

First seen7 Mar 2026

Sources

CVE-2025-63040 · NVD

Track software like this

Free during beta