We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2025-24289



Description

A Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerability in the UCRM Client Signup Plugin (v1.3.4 and earlier) could allow privilege escalation if an Administrator is tricked into visiting a crafted malicious page. The plugin is disabled by default.

Reserved 2025-01-17 | Published 2025-06-29 | Updated 2025-06-29 | Assigner hackerone


HIGH: 7.5CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Product status

Default status
unaffected

1.3.5 before 1.3.5
affected

References

community.ui.com/...048/af007d99-bb6d-4368-a12f-75e84de19e8d

cve.org (CVE-2025-24289)

nvd.nist.gov (CVE-2025-24289)

Download JSON

Share this page
https://cve.threatint.eu/CVE/CVE-2025-24289

Support options

Helpdesk Chat, Email, Knowledgebase