CVE-2025-58831

MediumCVSS 4.3

Published: 05/09/2025(UTC)Updated: 05/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

4th percentile - higher than 4% of all known CVEs

Summary

The Parallax Scrolling Enllax.js plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 0.0.6. This vulnerability allows unauthenticated attackers to perform unwanted actions in the context of an administrator.

Risk Assessment

An attacker could exploit CSRF to perform unauthorized operations in the administrator context, potentially leading to site integrity compromise or takeover. The risk depends on the functions available in the plugin.

Recommendation

Update the plugin to a patched version. Also, implement CSRF protections such as nonce tokens in all forms and actions.

Other vulnerabilities in Parallax Scrolling Enllax.js

CVE-2025-58830Medium
The WordPress plugin Parallax Scrolling Enllax.js up to version 0.0.6 contains a Stored XSS vulnerability due to improper input neutralization during web page generation. An attacker can inject a malicious script that gets stored and executed in the victim's browser.

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) vulnerability in snagysandor Parallax Scrolling Enllax.js parallax-scrolling-enllax-js allows Cross Site Request Forgery.This issue affects Parallax Scrolling Enllax.js: from n/a through <= 0.0.6.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS