CVE-2025-58956: High – Cross-Site Request Forgery (CSRF) vulnerability in loopus WP

CWE Weakness Definitions

CWE-352: Cross-Site Request Forgery (CSRF)

Web application does not verify that a request was intentionally sent by the authenticated user.

Related Attack Patterns (CAPEC)

CAPEC-462 Cross-Domain Search Timing

via CWE-352

CAPEC-467 Cross Site Identification

via CWE-352

CAPEC-62 Cross Site Request Forgery

via CWE-352

CAPEC-111 JSON Hijacking (aka JavaScript Hijacking)

via CWE-352

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A high severity vulnerability affects Loopus systems (CVE-2025-58956). No public exploit code is currently available. Apply available vendor patches promptly.

BSID: BS-2025-GLOBAL-298427-H • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →

Frequently Asked Questions

What is CVE-2025-58956?

A high severity vulnerability affects Loopus systems (CVE-2025-58956). No public exploit code is currently available. Apply available vendor patches promptly.

What is the CVSS score for CVE-2025-58956?

CVE-2025-58956 has CVSS 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS: 0.1%.

Is CVE-2025-58956 actively exploited?

No confirmed active exploitation of CVE-2025-58956 as of 2026-10-12.

How do I remediate CVE-2025-58956?

Priority: MEDIUM.

What systems are affected by CVE-2025-58956?

CVE-2025-58956 affects Loopus; Paypal; Stripe.

Vulnerability Details

CVE ID	`CVE-2025-58956`
BSID	`BS-2025-GLOBAL-298427-H` BreachSpider Global ID
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L`
Published	2025-09-22
Last Modified	2026-10-11
ICS Relevance	0%
Weakness (CWE)	Cross-Site Request Forgery (CSRF)
Source	NVD

Official Description

Cross-Site Request Forgery (CSRF) vulnerability in loopus WP Attractive Donations System wp-attractive-donations-system-easy-stripe-paypal-donations allows Stored XSS.This issue affects WP Attractive Donations System: from n/a through < 1.29.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: Cross-Site Request Forgery (CSRF) vulnerability in loopus WP Attractive Donations System wp-attractive-donations-system-easy-stripe-paypal-donations allows Stored XSS.This issue affects WP Attractive Donations System: from n/a through < 1.29. CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L.

Exploitation Likelihood: MINIMAL

Affected Products

Vendor	Product	Affected Versions
Loopus	—	—
Paypal	—	—
Stripe	—	—

Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence

● Threat Intelligence Validated: October 2026 | Threat Age: 388 Days

CISA known-exploited	Not in KEV catalog
Public Exploit	Not confirmed
PoC Code	Not confirmed

AI Enrichment Record — provenance & audit hash

Model	`rule-based-v1`
Confidence	MEDIUM
Enriched At	2026-05-24
SHA-512 Audit Hash	`00e963f40e7dfc68cb166421d3961ec014ffe8723d49e8878738f8d07fd363b25fcd9e21bccaff39b599d1c382241541da39ba0357a5dee5aa70580e91a32015`

Related CVEs affecting Loopus

CVE-2026-28115 9.3 Improper Neutralization of Special Elements used in an SQL Command ('SQL Inje... CVE-2024-30489 8.5 Improper Neutralization of Special Elements used in an SQL Command ('SQL Inje... CVE-2026-24363 7.5 Missing Authorization vulnerability in loopus WP Cost Estimation & Payment Fo... CVE-2025-22715 7.5 Missing Authorization vulnerability in loopus WP Attractive Donations System ... CVE-2025-22725 7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scri...

View all Loopus CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →