CVE-2025-48146: WordPress SEO Flow by LupsOnline plugin <= 2.2.1 - CSRF to Stored XSS vulnerability
Published May 16, 2025
·Updated
Cross-Site Request Forgery (CSRF) vulnerability in Michael Lups SEO Flow by LupsOnline lupsonline-link-netwerk allows Stored XSS.This issue affects SEO Flow by LupsOnline: from n/a through <= 2.2.1.
Affected Software
3 affected components
LupsOnline SEO Flow<=2.2.0
LupsOnline WordPress SEO Flow<=2.2.0
LupsOnline Seo Flow Wordpress<=2.2.0
Event History
May 16, 2025
CVE Published
via MITRE·03:45 PM
Data Sourced
via MITRE·03:45 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeaknessAffected Software
Oct 9, 58279
Event
via MITRE·03:21 PM
Frequently Asked Questions
1
What is the severity of CVE-2025-48146?
CVE-2025-48146 is a high severity Cross-Site Request Forgery (CSRF) vulnerability that can lead to Stored XSS in the affected versions.
2
How do I fix CVE-2025-48146?
To fix CVE-2025-48146, update SEO Flow by LupsOnline to version 2.2.1 or later.
3
Which versions of SEO Flow by LupsOnline are affected by CVE-2025-48146?
CVE-2025-48146 affects all versions of SEO Flow by LupsOnline from n/a to 2.2.0.
4
What type of vulnerability is CVE-2025-48146?
CVE-2025-48146 is categorized as a Cross-Site Request Forgery (CSRF) vulnerability.
5
Can CVE-2025-48146 lead to data compromise?
Yes, CVE-2025-48146 can lead to data compromise by enabling Stored XSS attacks.