CVE-2025-1382

The Contact Us By Lord Linus WordPress plugin through 2.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.

Score

CVSS 3.1 6.1 Medium

Status

Modified - contact@wpscan.com

Published

2025-03-09

Last modified

2026-01-09

Weaknesses

CWE-352, CWE-79

Affected products

• Contact Us (Lordlinus)
• Contact Us By Lord Linus (Unknown)

References

• https://wpscan.com/vulnerability/a3002265-ac83-4c00-8afb-cbfbb4afc1e9/