CVE-2025-24715 - Vulnerability Details

Vendors	Products
Wow-company	Counter Box

Link	Providers
https://patchstack.com/database/wordpress/plugin/counter-box/vulnerability/wordpress-counter-box-plugin-2-0-5-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve

Type	Values Removed	Values Added
First Time appeared		Wow-company Wow-company counter Box
CPEs		cpe:2.3:a:wow-company:counter_box::::::wordpress::*
Vendors & Products		Wow-company Wow-company counter Box

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Counter Box allows Cross Site Request Forgery. This issue affects Counter Box: from n/a through 2.0.5.
Title		WordPress Counter Box Plugin <= 2.0.5 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability
Weaknesses		CWE-352
References		https://patchstack.com/database/wordpress/plugin/counter-box/vulnerability/wordpress-counter-box-plugin-2-0-5-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-24715", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2025-01-23T14:52:38.446Z", "datePublished": "2025-01-24T17:25:06.483Z", "dateUpdated": "2025-01-24T18:38:43.658Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2025-01-24T17:25:06.483Z"}, "title": "WordPress Counter Box Plugin <= 2.0.5 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability", "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "lang": "en", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-62", "descriptions": [{"lang": "en", "value": "CAPEC-62 Cross Site Request Forgery"}]}], "affected": [{"vendor": "Wow-Company", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "counter-box", "product": "Counter Box", "versions": [{"lessThanOrEqual": "2.0.5", "status": "affected", "version": "n/a", "versionType": "custom", "changes": [{"at": "2.0.6", "status": "unaffected"}]}]}], "descriptions": [{"lang": "en", "value": "Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Counter Box allows Cross Site Request Forgery. This issue affects Counter Box: from n/a through 2.0.5.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Counter Box allows Cross Site Request Forgery.</p><p>This issue affects Counter Box: from n/a through 2.0.5.</p>"}]}], "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/wordpress/plugin/counter-box/vulnerability/wordpress-counter-box-plugin-2-0-5-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "baseSeverity": "MEDIUM", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "version": "3.1"}}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update the WordPress Counter Box wordpress plugin to the latest available version (at least 2.0.6)."}], "value": "Update the WordPress Counter Box wordpress plugin to the latest available version (at least 2.0.6)."}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Khang Duong (Patchstack Alliance)"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-24T18:38:34.071687Z", "id": "CVE-2025-24715", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-24T18:38:43.658Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2025-24715 (string)

assignerOrgId : 21595511-bba5-4825-b968-b78d1f9984a3 (string)

state : PUBLISHED (string)

assignerShortName : Patchstack (string)

dateReserved : 2025-01-23T14:52:38.446Z (string)

datePublished : 2025-01-24T17:25:06.483Z (string)

dateUpdated : 2025-01-24T18:38:43.658Z (string)

}

containers : { »

cna : { »

providerMetadata : { »

orgId : 21595511-bba5-4825-b968-b78d1f9984a3 (string)

shortName : Patchstack (string)

dateUpdated : 2025-01-24T17:25:06.483Z (string)

}

title : WordPress Counter Box Plugin <= 2.0.5 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability (string)

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-352 (string)

description : CWE-352 Cross-Site Request Forgery (CSRF) (string)

lang : en (string)

type : CWE (string)

}

]

}

]

impacts : [ »

0 : { »

capecId : CAPEC-62 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-62 Cross Site Request Forgery (string)

}

]

}

]

affected : [ »

0 : { »

vendor : Wow-Company (string)

collectionURL : https://wordpress.org/plugins (string)

defaultStatus : unaffected (string)

packageName : counter-box (string)

product : Counter Box (string)

versions : [ »

0 : { »

lessThanOrEqual : 2.0.5 (string)

status : affected (string)

version : n/a (string)

versionType : custom (string)

changes : [ »

0 : { »

at : 2.0.6 (string)

status : unaffected (string)

}

]

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Counter Box allows Cross Site Request Forgery. This issue affects Counter Box: from n/a through 2.0.5. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

base64 : false (boolean)

value : Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Counter Box allows Cross Site Request Forgery.This issue affects Counter Box: from n/a through 2.0.5. (string)

}

]

}

]

references : [ »

0 : { »

tags : [ »

0 : vdb-entry (string)

]

url : https://patchstack.com/database/wordpress/plugin/counter-box/vulnerability/wordpress-counter-box-plugin-2-0-5-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve (string)

}

]

metrics : [ »

0 : { »

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

cvssV3_1 : { »

baseScore : 5.4 (number)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L (string)

baseSeverity : MEDIUM (string)

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : LOW (string)

confidentialityImpact : NONE (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

version : 3.1 (string)

}

]

solutions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : Update the WordPress Counter Box wordpress plugin to the latest available version (at least 2.0.6). (string)

}

]

value : Update the WordPress Counter Box wordpress plugin to the latest available version (at least 2.0.6). (string)

}

]

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

user : 00000000-0000-4000-9000-000000000000 (string)

value : Khang Duong (Patchstack Alliance) (string)

}

]

source : { »

discovery : EXTERNAL (string)

}

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-01-24T18:38:34.071687Z (string)

id : CVE-2025-24715 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-01-24T18:38:43.658Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-24715", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-24T18:38:34.071687Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-24T18:38:38.367Z"}}], "cna": {"title": "WordPress Counter Box Plugin <= 2.0.5 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Khang Duong (Patchstack Alliance)"}], "impacts": [{"capecId": "CAPEC-62", "descriptions": [{"lang": "en", "value": "CAPEC-62 Cross Site Request Forgery"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Wow-Company", "product": "Counter Box", "versions": [{"status": "affected", "changes": [{"at": "2.0.6", "status": "unaffected"}], "version": "n/a", "versionType": "custom", "lessThanOrEqual": "2.0.5"}], "packageName": "counter-box", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update the WordPress Counter Box wordpress plugin to the latest available version (at least 2.0.6).", "supportingMedia": [{"type": "text/html", "value": "Update the WordPress Counter Box wordpress plugin to the latest available version (at least 2.0.6).", "base64": false}]}], "references": [{"url": "https://patchstack.com/database/wordpress/plugin/counter-box/vulnerability/wordpress-counter-box-plugin-2-0-5-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Counter Box allows Cross Site Request Forgery. This issue affects Counter Box: from n/a through 2.0.5.", "supportingMedia": [{"type": "text/html", "value": "<p>Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Counter Box allows Cross Site Request Forgery.</p><p>This issue affects Counter Box: from n/a through 2.0.5.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2025-01-24T17:25:06.483Z"}}}, "cveMetadata": {"cveId": "CVE-2025-24715", "state": "PUBLISHED", "dateUpdated": "2025-01-24T18:38:43.658Z", "dateReserved": "2025-01-23T14:52:38.446Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2025-01-24T17:25:06.483Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2025-24715 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-01-24T18:38:34.071687Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-01-24T18:38:38.367Z (string)

}

]

cna : { »

title : WordPress Counter Box Plugin <= 2.0.5 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability (string)

source : { »

discovery : EXTERNAL (string)

}

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

user : 00000000-0000-4000-9000-000000000000 (string)

value : Khang Duong (Patchstack Alliance) (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-62 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-62 Cross Site Request Forgery (string)

}

]

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 5.4 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L (string)

integrityImpact : LOW (string)

userInteraction : REQUIRED (string)

attackComplexity : LOW (string)

availabilityImpact : LOW (string)

privilegesRequired : NONE (string)

confidentialityImpact : NONE (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : Wow-Company (string)

product : Counter Box (string)

versions : [ »

0 : { »

status : affected (string)

changes : [ »

0 : { »

at : 2.0.6 (string)

status : unaffected (string)

}

]

version : n/a (string)

versionType : custom (string)

lessThanOrEqual : 2.0.5 (string)

}

]

packageName : counter-box (string)

collectionURL : https://wordpress.org/plugins (string)

defaultStatus : unaffected (string)

}

]

solutions : [ »

0 : { »

lang : en (string)

value : Update the WordPress Counter Box wordpress plugin to the latest available version (at least 2.0.6). (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : Update the WordPress Counter Box wordpress plugin to the latest available version (at least 2.0.6). (string)

base64 : false (boolean)

}

]

}

]

references : [ »

0 : { »

url : https://patchstack.com/database/wordpress/plugin/counter-box/vulnerability/wordpress-counter-box-plugin-2-0-5-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve (string)

tags : [ »

0 : vdb-entry (string)

]

}

]

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Counter Box allows Cross Site Request Forgery. This issue affects Counter Box: from n/a through 2.0.5. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Counter Box allows Cross Site Request Forgery.This issue affects Counter Box: from n/a through 2.0.5. (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-352 (string)

description : CWE-352 Cross-Site Request Forgery (CSRF) (string)

}

]

}

]

providerMetadata : { »

orgId : 21595511-bba5-4825-b968-b78d1f9984a3 (string)

shortName : Patchstack (string)

dateUpdated : 2025-01-24T17:25:06.483Z (string)

}

cveMetadata : { »

cveId : CVE-2025-24715 (string)

state : PUBLISHED (string)

dateUpdated : 2025-01-24T18:38:43.658Z (string)

dateReserved : 2025-01-23T14:52:38.446Z (string)

assignerOrgId : 21595511-bba5-4825-b968-b78d1f9984a3 (string)

datePublished : 2025-01-24T17:25:06.483Z (string)

assignerShortName : Patchstack (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wow-company:counter_box:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "510D2249-A147-4E35-A7C4-CAB3239FADD8", "versionEndExcluding": "2.0.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Counter Box allows Cross Site Request Forgery. This issue affects Counter Box: from n/a through 2.0.5."}, {"lang": "es", "value": "La vulnerabilidad Cross-Site Request Forgery (CSRF) en Wow-Company Counter Box permite Cross Site Request Forgery. Este problema afecta a Counter Box: desde n/a hasta 2.0.5."}], "id": "CVE-2025-24715", "lastModified": "2025-06-09T18:55:37.650", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "audit@patchstack.com", "type": "Secondary"}]}, "published": "2025-01-24T18:15:44.913", "references": [{"source": "audit@patchstack.com", "tags": ["Third Party Advisory"], "url": "https://patchstack.com/database/wordpress/plugin/counter-box/vulnerability/wordpress-counter-box-plugin-2-0-5-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "audit@patchstack.com", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:wow-company:counter_box:*:*:*:*:*:wordpress:*:* (string)

matchCriteriaId : 510D2249-A147-4E35-A7C4-CAB3239FADD8 (string)

versionEndExcluding : 2.0.6 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Counter Box allows Cross Site Request Forgery. This issue affects Counter Box: from n/a through 2.0.5. (string)

}

1 : { »

lang : es (string)

value : La vulnerabilidad Cross-Site Request Forgery (CSRF) en Wow-Company Counter Box permite Cross Site Request Forgery. Este problema afecta a Counter Box: desde n/a hasta 2.0.5. (string)

}

]

id : CVE-2025-24715 (string)

lastModified : 2025-06-09T18:55:37.650 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : LOW (string)

baseScore : 5.4 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 2.5 (number)

source : audit@patchstack.com (string)

type : Secondary (string)

}

]

}

published : 2025-01-24T18:15:44.913 (string)

references : [ »

0 : { »

source : audit@patchstack.com (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://patchstack.com/database/wordpress/plugin/counter-box/vulnerability/wordpress-counter-box-plugin-2-0-5-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve (string)

}

]

sourceIdentifier : audit@patchstack.com (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-352 (string)

}

]

source : audit@patchstack.com (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object