{"id":"CVE-2025-24749","state":"PUBLISHED","title":"WordPress  EZPZ SAML SP Single Sign On (SSO) plugin <= 1.2.5 - CSRF to Stored XSS vulnerability","description":"Cross-Site Request Forgery (CSRF) vulnerability in Overt Software Solutions LTD EZPZ SAML SP Single Sign On (SSO) allows Cross Site Request Forgery. This issue affects EZPZ SAML SP Single Sign On (SSO): from n/a through 1.2.5.","publishedAt":"2025-01-31T08:24:41.763Z","updatedAt":"2026-04-28T16:11:33.921Z","severity":{"score":7.1,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","source":"Patchstack"},"assigner":"Patchstack","products":["Overt Software Solutions LTD EZPZ SAML SP Single Sign On (SSO)"],"affected":[{"vendor":"Overt Software Solutions LTD","product":"EZPZ SAML SP Single Sign On (SSO)","packageName":"ezpz-sp","defaultStatus":"unaffected","versions":[{"version":"n/a","status":"affected","lessThanOrEqual":"1.2.5","changes":[{"at":"1.2.6","status":"unaffected"}],"versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"}],"references":["https://patchstack.com/database/wordpress/plugin/ezpz-sp/vulnerability/wordpress-ezpz-saml-sp-single-sign-on-sso-plugin-1-2-5-csrf-to-stored-xss-vulnerability?_s_id=cve"],"weaknesses":["CWE-352"],"ingestedAt":"2026-10-29T20:08:47.682Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/24xxx/CVE-2025-24749.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-24749","state":"PUBLISHED","datePublished":"2025-01-31T08:24:41.763Z","dateUpdated":"2026-04-28T16:11:33.921Z","assignerShortName":"Patchstack","assignerOrgId":"21595511-bba5-4825-b968-b78d1f9984a3","dateReserved":"2025-01-23T14:53:00.531Z"},"containers":{"cna":{"title":"WordPress  EZPZ SAML SP Single Sign On (SSO) plugin <= 1.2.5 - CSRF to Stored XSS vulnerability","descriptions":[{"lang":"en","value":"Cross-Site Request Forgery (CSRF) vulnerability in Overt Software Solutions LTD EZPZ SAML SP Single Sign On (SSO) allows Cross Site Request Forgery. This issue affects EZPZ SAML SP Single Sign On (SSO): from n/a through 1.2.5."}],"affected":[{"vendor":"Overt Software Solutions LTD","product":"EZPZ SAML SP Single Sign On (SSO)","packageName":"ezpz-sp","defaultStatus":"unaffected","versions":[{"version":"n/a","status":"affected","lessThanOrEqual":"1.2.5","changes":[{"at":"1.2.6","status":"unaffected"}],"versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/ezpz-sp/vulnerability/wordpress-ezpz-saml-sp-single-sign-on-sso-plugin-1-2-5-csrf-to-stored-xss-vulnerability?_s_id=cve","tags":["vdb-entry"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-352","description":"CWE-352 Cross-Site Request Forgery (CSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Patchstack","orgId":"21595511-bba5-4825-b968-b78d1f9984a3","dateUpdated":"2026-04-28T16:11:33.921Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"SOPROBRO (Patchstack Alliance)"}],"impacts":[{"capecId":"CAPEC-62","descriptions":[{"lang":"en","value":"CAPEC-62 Cross Site Request Forgery"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Update the WordPress EZPZ SAML SP Single Sign On (SSO) plugin to the latest available version (at least 1.2.6)."}],"value":"Update the WordPress EZPZ SAML SP Single Sign On (SSO) plugin to the latest available version (at least 1.2.6)."}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-01-31T15:26:40.376149Z","id":"CVE-2025-24749","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-01-31T15:29:00.510Z"}}]}}}