CVE-2025-60145

MediumCVSS 4.3

Published: 26/09/2025(UTC)Updated: 11/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

3th percentile - higher than 3% of all known CVEs

Summary

The Lenix scss compiler plugin (up to version 1.2) contains a Cross-Site Request Forgery (CSRF) vulnerability, allowing an attacker to perform unauthorized actions in the context of a logged-in user.

Risk Assessment

The risk includes unauthorized changes to plugin configuration or other actions that may compromise site integrity.

Recommendation

It is recommended to update the Lenix scss compiler plugin to the latest version and implement CSRF protections such as tokens.

Other vulnerabilities in Lenix scss compiler

CVE-2025-60144Medium
The Lenix scss compiler plugin has a stored XSS vulnerability due to improper neutralization of input during web page generation. Affects versions up to and including 1.2.

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) vulnerability in yonifre Lenix scss compiler lenix-scss-compiler allows Cross Site Request Forgery.This issue affects Lenix scss compiler: from n/a through <= 1.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS