CVE-2021-25073: Webmaster-Source WP125

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

The WP125 WordPress plugin before 1.5.5 does not have CSRF checks in various action, for example when deleting an ad, allowing attackers to make a logged in admin delete them via a CSRF attack

Affected products

• Webmaster-Source WP125: before 1.5.5 (fixed in 1.5.5)

Published 2022-01-24. Last modified 2026-06-17.