What is CVE-2025-1436?

CVE-2025-1436 is a high-severity vulnerability in Rivercitygraphix Limit_bio, classified under Cross-Site Request Forgery (CSRF). CVSS score: 7.1/10. Published 2025-03-13.

How severe is CVE-2025-1436?

High severity. CVSS v3 base score is 7.1 out of 10.

CSRF in Rivercitygraphix Limit_bio

CVE-2025-1436

The Limit Bio WordPress plugin through 1.0 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.

Vulnerability class: CSRF (Cross-Site Request Forgery)

EPSS: 0.001 (4.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L.

Affected products

Rivercitygraphix Limit_bio — versions 1.0
Unknown Limit Bio — versions 0

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

References

contact@wpscan.com (Exploit, technical-description, Third Party Advisory, exploit, vdb-entry)

Frequently asked questions

What is CVE-2025-1436?: CVE-2025-1436 is a high-severity vulnerability in Rivercitygraphix Limit_bio, classified under Cross-Site Request Forgery (CSRF). CVSS score: 7.1/10. Published 2025-03-13.
How severe is CVE-2025-1436?: High severity. CVSS v3 base score is 7.1 out of 10.