CVE-2025-15635

MediumCVSS 4.3

Published: 15/04/2026(UTC)Updated: 07/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.11%

1th percentile - higher than 1% of all known CVEs

Summary

Cross-Site Request Forgery (CSRF) vulnerability in ZAYTECH Smart Online Order for Clover plugin. Allows an attacker to perform unauthorized actions on behalf of a logged-in user. Affects versions up to and including 1.6.0.

Risk Assessment

CSRF attack can lead to unauthorized changes in order configuration or customer data, potentially resulting in data integrity breach and loss of user trust.

Recommendation

Immediately update the plugin to the latest available version and implement CSRF protection mechanisms such as anti-CSRF tokens.

Other vulnerabilities in Smart Online Order for Clover

CVE-2026-66700High
The Smart Online Order for Clover plugin version 1.6.1 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser without requiring authentication.

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders allows Cross Site Request Forgery.This issue affects Smart Online Order for Clover: from n/a through <= 1.6.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS