CVE-2025-60115

MediumCVSS 4.3

Published: 26/09/2025(UTC)Updated: 11/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

3th percentile - higher than 3% of all known CVEs

Summary

CSRF vulnerability in the Instapage plugin. Allows an attacker to perform unauthorized requests on behalf of an administrator.

Risk Assessment

Potential to change integration settings or publish pages, affecting marketing campaigns.

Recommendation

Update the Instapage plugin to a patched version. Apply CSRF tokens in forms.

Other vulnerabilities in Instapage Plugin

CVE-2026-39728High
A vulnerability in the Instapage Plugin up to version 3.7.2 allows an unauthenticated attacker to perform a Server Side Request Forgery (SSRF) attack.

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) vulnerability in instapagedev Instapage Plugin instapage allows Cross Site Request Forgery.This issue affects Instapage Plugin: from n/a through <= 3.7.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS