CVE-2025-2479

This is a flaw in a WordPress add-on that can turn a specially made link into unwanted actions in the browser of someone who opens it. It is like a forged note that looks harmless but causes the recipient’s web session to follow instructions the attacker wrote.

This matters to you if your WordPress site uses Easy Custom Admin Bar. The risk applies to versions through 1.0 and requires someone to open an attacker-crafted link.

Attackers can exploit this by persuading a user to open a crafted link, which can run actions in that person’s browser under their website session. Treat this as urgent because no vendor fix is currently available: remove or disable the plugin while arranging a replacement.

1. Confirm installation and version in WordPress Admin → Plugins, or inspect the plugin directory and active-plugin configuration for Easy Custom Admin Bar. Versions up to and including 1.0 are affected.
2. There is no published fixed version or supported upgrade target. Disable the plugin first, then remove it after confirming that no site workflow depends on it.
3. If the feature is needed, replace it with a maintained alternative after testing it on a staging site; do not wait for an unannounced patch.
4. If removal must be delayed, limit access to WordPress administrator accounts, warn administrators not to open unexpected site-related links, and avoid exposing links containing the msg parameter to users.
5. Review WordPress administrator-account activity, unexpected plugin or theme changes, new user accounts, and web-server logs for suspicious requests containing msg. CISA has not assigned a KEV due date because this CVE is not listed in KEV.

CVE-2025-2479 is CVSS 6.1 (Medium), CWE-79 reflected cross-site scripting. The attack vector is network-based, requires no attacker privileges, but requires user interaction; successful exploitation can affect confidentiality and integrity in the victim’s browser session. No confirmed in-the-wild exploitation is reported, CISA KEV does not list it, and available exploit evidence is limited to a detection template rather than a weaponized exploit. EPSS is 0.3% (26th percentile) with a flat trend. No patch information is available.